Techniques for watermarking text generated using a language model and detecting whether text is watermarked

Abstract

Described herein are techniques for watermarking text generated using a language model (e.g., a generative language model) such that the text can be generated by the language model. The techniques involve using a partitioning of the language model's vocabulary performed with a secret key to modify the processing of an input by the language model in generating text. The modification in processing results in watermarked text. The detection of the watermark in the generated text may only be detected by an entity with access to the partitioning of the language model's vocabulary performed with the secret key. Described herein are also techniques for verifying whether text was generated by the language model by detecting whether the text is watermarked. The technique involves using the partitioning of the language model's vocabulary performed with the secret key to determine whether the text is watermarked.

Description

[0001] TECHNIQUES FOR WATERMARKING TEXT GENERATED USING A LANGUAGE MODEL AND DETECTING WHETHER TEXT IS WATERMARKED

[0002] RELATED APPLICATIONS

[0003] This application claims the benefit under 35 U.S.C. § 119(e) of U.S. Provisional Application No. 63 / 749,472 titled “TECHNIQUES FOR WATERMARKING TEXT GENERATED USING A LANGUAGE MODEL AND DETECTING WHETHER THE TEXT IS WATERMARKED,” filed on January 24, 2025, which is incorporated by reference herein.

[0004] GOVERNMENT SPONSORSHIP

[0005] This invention was made with government support under N00014-20- 1-2826 awarded by the Office of Naval Research. The government has certain rights in the invention.

[0006] BACKGROUND

[0007] The rapid proliferation of artificial intelligence (Al) generated content in various applications has necessitated the development of robust security measures to safeguard the integrity and authenticity of generated content. Watermarking is a technique to embed a unique, invisible signature in model outputs, to trace content origin, verifying authenticity, and preventing unauthorized use. Watermarking techniques are also valuable for preventing use of synthetic content for training machine learning models.

[0008] SUMMARY

[0009] Described herein are improved techniques for watermarking text generated using a language model (e.g., a generative language model) such that the text can be generated by the language model. The techniques involve using a partitioning of the language model’s vocabulary performed with a secret key to modify the processing of an input by the language model in generating text. The modification in processing results in watermarked text. The detection of the watermark in the generated text may only be detected by an entity with access to the partitioning of the language model’s vocabulary performed with the secret key. Described herein are also techniques for verifying whether text was generated by the language model by detecting whether the text is watermarked. The technique involves using the partitioning of the language model’s vocabulary performed with the secret key to determine whether the text is watermarked.In some embodiments, the techniques described herein relate to a method for watermarking text generated using a language model such that the text can be confirmed as being generated by the language model, the language model having a vocabulary, the method including: using a computer hardware processor to perform: obtaining a first vocabulary subset of the language model's vocabulary, the first vocabulary subset partitioned from the language model's vocabulary using a secret key; processing input to the language model to generate a set of watermarked text at least in part by: providing the input to the language model to obtain an output indicating a candidate token and a corresponding probability; determining, using the candidate token and the first vocabulary subset of the language model's vocabulary, an output token from which to generate the set of watermarked text at least in part by: determining whether the candidate token belongs to the first vocabulary subset of the language model's vocabulary; determining the output token based on a determination of whether the candidate token belongs to the first vocabulary subset; and generating the set of watermarked text using the output token.

[0010] In some embodiments, the techniques described herein relate to a method, wherein: the output of the language model indicates a plurality of probabilities corresponding to a plurality of candidate tokens, the plurality of candidate tokens including the candidate token; and determining the output token based on the determination of whether the candidate token belongs to the first vocabulary subset includes: if it is determined that the candidate token belongs to the first vocabulary subset, adjusting the probability corresponding to the candidate token to obtain an adjusted plurality of probabilities; and sampling the output token from the plurality of candidate tokens using the adjusted plurality of probabilities.

[0011] In some embodiments, the techniques described herein relate to a method, wherein determining the output token based on the determination of whether the candidate token belongs to the first vocabulary subset includes: if it is determined that the candidate token belongs to the first vocabulary subset, performing rejection sampling to obtain the output token.

[0012] In some embodiments, the techniques described herein relate to a method, wherein performing rejection sampling to obtain the output token includes: sampling a test value based on a target probability distribution; comparing the probability corresponding to the candidate token to the test value; determining whether to reject or accept the candidate token based on a result of comparing the probability to the test value; when it is determined to reject the candidate token, providing the input to the language model to obtain another candidate token and acorresponding probability; and when it is determined to accept the candidate token, using the candidate token as the output token.

[0013] In some embodiments, the techniques described herein relate to a method, wherein determining the output token based on the determination of whether the candidate token belongs to the first vocabulary subset includes: if it is determined that the candidate token does not belong to the first vocabulary subset, using the candidate token as the output token.

[0014] In some embodiments, the techniques described herein relate to a method, wherein processing the input to the language model to generate the set of watermarked text further includes: if it is determined that the candidate token belongs to the first vocabulary subset, removing the first token from the first vocabulary subset to obtain an updated first vocabulary subset.

[0015] In some embodiments, the techniques described herein relate to a method, wherein processing the input to the language model to generate the set of watermarked text further includes: after obtaining the output token: generating a second input to the language model using the output token; providing the second input to the language model to obtain a second candidate token and a corresponding second probability; determining, using the second candidate token and the updated first vocabulary subset, a second output token from which to generate the set of watermarked text; and generating the set of watermarked text using the second output token.

[0016] In some embodiments, the techniques described herein relate to a method, further including partitioning the language model's vocabulary to obtain the first vocabulary subset using the secret key.

[0017] In some embodiments, the techniques described herein relate to a method, wherein partitioning the language model's vocabulary to obtain the first vocabulary subset includes: computing, using the secret key, hash values for a plurality of tokens in the language model's vocabulary; and assigning a subset of the plurality of tokens to the first vocabulary subset using the hash values computed for the plurality of tokens.

[0018] In some embodiments, the techniques described herein relate to a method, wherein assigning the subset of the plurality of tokens to the first vocabulary subset using the hash values computed for the plurality of tokens includes: for each of at least some of the plurality of tokens: converting a hash value computed for the token into an integer value; computing a value of the integer value modulo 2; and determining whether to assign the token to the first vocabulary subset using the value of the integer value modulo 2.In some embodiments, the techniques described herein relate to a method, wherein partitioning the language model's vocabulary to obtain the first vocabulary subset includes: identifying tokens of the language model's vocabulary representing strings that most frequently appear in text from which the language model's vocabulary is derived; filtering out the identified tokens from the language model's vocabulary to obtain a filtered vocabulary; and partitioning the first vocabulary subset from the filtered vocabulary.

[0019] In some embodiments, the techniques described herein relate to a method for verifying whether text was generated by a language model by detecting whether the text is watermarked text, the language model having a vocabulary, the method including: using a computer hardware processor to perform: obtaining a first vocabulary subset and a second vocabulary subset of the language model's vocabulary, the first vocabulary subset and the second vocabulary subset partitioned from the language model's vocabulary using a secret key; tokenizing the text to obtain a set of tokens from the language model's vocabulary representing the text; determining a number of tokens in the set of tokens that belong to the first vocabulary subset and a number of tokens in the set of tokens that belong to the second vocabulary subset; and determining whether the text is watermarked using the number of tokens in the set of tokens that belong to the first vocabulary subset and the number of tokens in the set of tokens that belong to the second vocabulary subset.

[0020] In some embodiments, the techniques described herein relate to a method, wherein: determining the number of tokens in the set of tokens that belong to the first vocabulary subset includes determining a number of unique tokens in the set of tokens that belong to the first vocabulary subset; and determining the number of tokens in the set of tokens that belong to the second vocabulary subset includes determining a number of unique tokens in the set of tokens that belong to the second vocabulary subset.

[0021] In some embodiments, the techniques described herein relate to a method, wherein determining whether the text is watermarked includes: determining an expected number of tokens in the text that belong to the first vocabulary subset based on a ratio of a number of tokens in the first vocabulary subset to a total number of tokens in the first vocabulary subset and the second vocabulary subset; and determining whether the text is watermarked based on the expected number of tokens that belong to the first vocabulary subset.

[0022] In some embodiments, the techniques described herein relate to a method, wherein determining whether the text is watermarked based on the expected number of tokens thatbelong to the first vocabulary subset and the number of tokens includes: performing a binomial test to obtain a p-value using the number of tokens in the set of tokens that belong to the first vocabulary subset, the number of tokens in the set of tokens that belong to the second vocabulary subset, and the expected number of tokens in the text that belong to the first vocabulary subset; and determining whether the text is watermarked based on the p-value.

[0023] In some embodiments, the techniques described herein relate to a method, further including partitioning the language model's vocabulary to obtain the first vocabulary subset and the second vocabulary subset using the secret key.

[0024] In some embodiments, the techniques described herein relate to a method, wherein partitioning the language model's vocabulary to obtain the first vocabulary subset and the second vocabulary subset includes: computing, using the secret key, hash values for the plurality of tokens; and assigning, using the hash values computed for the plurality of tokens: a first subset of the plurality of tokens to the first vocabulary subset; and a second subset of the plurality of tokens to the second vocabulary subset.

[0025] In some embodiments, the techniques described herein relate to a method, wherein partitioning the language model's vocabulary to obtain the first vocabulary subset and the second vocabulary subset includes: identifying tokens of the language model's vocabulary representing values that most frequently appear in text from which the language model's vocabulary is derived; filtering out the identified tokens from the language model's vocabulary to obtain a filtered vocabulary; and partitioning the first vocabulary subset and the second vocabulary subset from the filtered vocabulary.

[0026] In some embodiments, the techniques described herein relate to a system for watermarking text generated using a language model such that the text can be confirmed as being generated by the language model, the language model having a vocabulary. The system comprises a computer hardware processor, and a non-transitory computer-readable storage medium storing instructions. The instructions, when executed by the computer hardware processor, cause the computer hardware processor to: obtain a first vocabulary subset of the language model’s vocabulary, the first vocabulary subset partitioned from the language model’s vocabulary using a secret key; process input to the language model to generate a set of watermarked text at least in part by: provide the input to the language model to obtain an output indicating a candidate token and a corresponding probability; determine, using the candidate token and the first vocabulary subset of the language model’s vocabulary, an output token fromwhich to generate the set of watermarked text at least in part by: determine whether the candidate token belongs to the first vocabulary subset of the language model’s vocabulary; determine the output token based on a determination of whether the candidate token belongs to the first vocabulary subset; and generate the set of watermarked text using the output token.

[0027] In some embodiments, the techniques described herein relate to a non-transitory computer-readable storage medium storing instructions that, when executed by a computer hardware processor, cause the computer hardware processor to perform a method for watermarking text generated using a language model such that the text can be confirmed as being generated by the language model, the language model having a vocabulary. The method comprises: obtaining a first vocabulary subset of the language model’s vocabulary, the first vocabulary subset partitioned from the language model’s vocabulary using a secret key; processing input to the language model to generate a set of watermarked text at least in part by: providing the input to the language model to obtain an output indicating a candidate token and a corresponding probability; determining, using the candidate token and the first vocabulary subset of the language model’s vocabulary, an output token from which to generate the set of watermarked text at least in part by: determining whether the candidate token belongs to the first vocabulary subset of the language model’s vocabulary; determining the output token based on a determination of whether the candidate token belongs to the first vocabulary subset; and generating the set of watermarked text using the output token.

[0028] In some embodiments, the techniques described herein relate to a system for verifying whether text was generated by a language model by detecting whether the text is watermarked text, the language model having a vocabulary. The system comprises a computer hardware processor, and a non-transitory computer-readable storage medium storing instructions. The instructions, when executed by the computer hardware processor, cause the computer hardware processor to: obtain a first vocabulary subset and a second vocabulary subset of the language model’s vocabulary, the first vocabulary subset and the second vocabulary subset partitioned from the language model’s vocabulary using a secret key; tokenize the text to obtain a set of tokens from the language model’s vocabulary representing the text; determine a number of tokens in the set of tokens that belong to the first vocabulary subset and a number of tokens in the set of tokens that belong to the second vocabulary subset; and determine whether the text is watermarked using the number of tokens in the set of tokens that belong to the first vocabulary subset and the number of tokens in the set of tokens that belong to the second vocabulary subset.In some embodiments, the techniques described herein relate to a non-transitory computer-readable storage medium storing instructions that, when executed by a computer hardware processor, cause the computer hardware processor to perform a method for verifying whether text was generated by a language model by detecting whether the text is watermarked text, the language model having a vocabulary. The method includes: obtaining a first vocabulary subset and a second vocabulary subset of the language model's vocabulary, the first vocabulary subset and the second vocabulary subset partitioned from the language model's vocabulary using a secret key; tokenizing the text to obtain a set of tokens from the language model's vocabulary representing the text; determining a number of tokens in the set of tokens that belong to the first vocabulary subset and a number of tokens in the set of tokens that belong to the second vocabulary subset; and determining whether the text is watermarked using the number of tokens in the set of tokens that belong to the first vocabulary subset and the number of tokens in the set of tokens that belong to the second vocabulary subset.

[0029] The foregoing summary is non-limiting.

[0030] BRIEF DESCRIPTION OF DRAWINGS

[0031] Various aspects and embodiments will be described with reference to the following figures. It should be appreciated that the figures are not necessarily drawn to scale. Items appearing in multiple figures are indicated by the same or a similar reference number in all the figures in which they appear.

[0032] FIG. 1 is a block diagram illustrating a watermarking system, according to some embodiments of the technology described herein.

[0033] FIG. 2 is a block diagram illustrating a vocabulary partitioning module, according to some embodiments of the technology described herein.

[0034] FIG. 3 is a block diagram illustrating a watermarking module, according to some embodiments of the technology described herein.

[0035] FIG. 4 is a block diagram illustrating a watermark detection module, according to some embodiments of the technology described herein.

[0036] FIG. 5 is a flowchart illustrating a process for partitioning a language module vocabulary, according to some embodiments of the technology described herein.

[0037] FIG. 6 is a flowchart illustrating a process for outputting watermarked text, according to some embodiments of the technology described herein.FIG. 7 is a flowchart illustrating a process for detecting a watermark, according to some embodiments of the technology described herein.

[0038] FIG. 8 shows a block diagram of an exemplary computing device that may be specially configured to implement some embodiments of the technology described herein.

[0039] DETAILED DESCRIPTION

[0040] I. Overview

[0041] The inventors have developed techniques for watermarking text generated using a language model (e.g., a large language model (LLM)) such that the text can be confirmed as being generated by the language model. For example, the techniques described herein can distinguish content generated from a particular language model from human- authored content, content that has been modified by a human, content generated by another language model. These techniques may be used to cryptographically prove that a particular system configured to use the language model in the system that generated text. This may facilitate tracing content origin, verifying authenticity, and preventing unauthorized use of the system. These techniques can be used in various contexts, including by developers and users to identify whether a piece of text was originated from a specific LLM (which is crucial for accountability and copyright compliance), to help mitigate risks of misuse (e.g., the creation of misleading or harmful content) and to meet legal or ethical standards for usage by clearly distinguishing LLM-generated outputs.

[0042] Watermarking involves embedding a unique, invisible signature in the output of a language model to trace content origin, verify its authenticity, and prevent unauthorized use of the language model. The watermark is often designed to be imperceptible to end users, maintaining fluency and naturalness while being detectable through specialized tools or algorithms. Some conventional watermarking techniques involve partitioning a language model’s vocabulary into two lists using a secret key and modifying output generation performed using the language model based on the partitioned lists. These lists may also be referred to as a “green list” and a “red list.” The step of partitioning the language model’s vocabulary into lists is performed at each iteration of the output generation process. Output generation is modified such that output text generated by the language model includes mostly tokens belonging to one of the two lists (e.g., the green list). During each iteration of a generation process performed to obtain output tokens, the vocabulary of the language model is divided into two lists (which may be referred to as a “red list” and a“green list”), and the probability distribution of output tokens obtained in the iteration is modified such that the likelihood of sampling a token from the green list is increased.

[0043] The inventors have recognized limitations with conventional watermarking techniques that use partitioning of a language model’s vocabulary obtained using a secret key to modify output generation. Conventional techniques are prone to false-positive errors where text is incorrectly identified as watermarked. The inventors have recognized that this limitation is particularly severe with texts that contain specific vocabulary. For example, in a biography of Albert Einstein, if the words ’Albert’ and ’Einstein’ are on the green list, the model might erroneously detect the text as watermarked due to the high frequency of these words. Other proposed approaches either demand significant computational resources for watermark implementation and detection, limiting their widespread adoption, or they sacrifice robustness to editing attacks.

[0044] The inventors have developed techniques that address the limitations described above. Techniques described herein have lower time complexity relative to conventional techniques. Accordingly, some embodiments provide a more computationally efficient watermarking process. In contrast to conventional techniques, in which a language model’s vocabulary is partitioned in each iteration of an output generation process, techniques described partition the vocabulary once and use the partitions obtained therefrom in all iterations of the output generation process. The static vocabulary partitions eliminate the computations associated with partitioning from iterations of the output generation process, thereby improving the efficiency of watermarking performed by a system over conventional techniques.

[0045] Some embodiments further partition a language model’s vocabulary to include an additional list of tokens that includes at least some of the most frequently used tokens in the language. This list additional list may be referred to as a “white list” (which would be generated in addition to a red and green list). Generation of the white list is unaffected by the generation of the green list and the red list. In addition to limiting the partitioning step to be solely performed before the performance of the watermarking steps, some embodiments involve a clearing mechanism, in which tokens identified in the text as being part of the red list are removed. This clearing mechanism eliminates or reduces the need to perform watermarking several times as a result of repetitive text. When clearing is applied, watermark detection is performed on the basis of unique green and red tokens (a token is referred to as a “green token” if it is identified as belonging to the green list or as a “red token” if it is identified as belonging to the red list). This guarantees accurate detection even in the presence of repetitive text. The techniques describedherein improve upon conventional approaches in that they reduce the rate of false-positive errors while preserving performance, text quality and robustness.

[0046] Some embodiments relate to a method for watermarking text generated using a language model such that the text can be confirmed as being generated by the language model. The language model has a vocabulary. The method may include i) obtaining a first vocabulary subset of the language model’s vocabulary, the first vocabulary subset being partitioned from the language model’s vocabulary using a secret key, and ii) processing input to the language model to generate a set of watermarked text. Processing the input may include providing the input to the language model to obtain an output indicating a candidate token and a corresponding probability, determining, using the candidate token and the first vocabulary subset of the language model’s vocabulary, an output token from which to generate the set of watermarked text, and generating the set of watermarked text using the output token. Determining the output token may include determining whether the candidate token belongs to the first vocabulary subset of the language model’s vocabulary, determining the output token based on a determination of whether the candidate token belongs to the first vocabulary subset.

[0047] Further embodiments relate to a method for verifying whether text was generated by a language model by detecting whether the text is watermarked text. The language model has a vocabulary. The method may include i) obtaining a first vocabulary subset and a second vocabulary subset of the language model’s vocabulary, the first vocabulary subset and the second vocabulary subset partitioned from the language model’s vocabulary using a secret key, ii) tokenizing the text to obtain a set of tokens from the language model’s vocabulary representing the text, iii) determining a number of tokens in the set of tokens that belong to the first vocabulary subset and a number of tokens in the set of tokens that belong to the second vocabulary subset, and iv) determining whether the text is watermarked using the number of tokens in the set of tokens that belong to the first vocabulary subset and the number of tokens in the set of tokens that belong to the second vocabulary subset.

[0048] FIG. 1 is a block diagram illustrating a watermarking system, according to some embodiments of the technology described herein. Watermarking system 100 includes a language model (LM) vocabulary partitioning module 102, a watermarking module 104 and a watermark detection module 106. Additionally, watermarking system 100 includes a memory unit 108 storing a language model 120, LM vocabulary subsets 110A and HOB and exempt vocabulary 110C. LM 120 includes software instructions that, when executed, perform generation of text using alanguage model. LM vocabulary subsets 110A and HOB and exempt vocabulary HOC represent subsets of the vocabulary of LM model 120 following a partition, as described in detail further below.

[0049] In some embodiments, as indicated in FIG. 1, the watermarking module 104 may be configured to perform a task of watermark generation and the watermark detection module 106 may be configured to perform a task of watermark detection. Although in the example of FIG. 1 the watermarking module 104 and the watermark detection module 106 are shown as being part of one system 100, in some embodiments, the watermarking module 104 and the watermark detection module 106 may be executed by separate systems. For example, one computer system be configured to execute the watermarking module 104 and another computer system may be configured to execute the watermark detection module 106.

[0050] The watermarking module 104 may use the LM vocabulary partitioning module 102 and the memory unit 108 (e.g., storing the LM vocabulary subsets 110A, HOB, and, optionally HOC, and the language model 120. In some embodiments, the watermark detection module 106 may use the LM vocabulary partitioning module 102. In some embodiments, the watermark detection module 106 may not need the memory unit 108 to perform processing. For example, the watermark detection module 106 may use the LM vocabulary partitioning module 102 to generate the vocabulary subsets 110A, HOB and use them to perform detection (e.g., as described herein with reference to FIG. 4). The watermark detection module 106 may not need access to the LM 120 for which a watermark (e.g., generated by the watermarking module 104 is being detected.

[0051] LM vocabulary partitioning module 102 comprises one or more software programs configured to, when executed, partition a LM vocabulary into multiple subsets using a secret key (K) 112. Secret key 112 includes a cryptographic or algorithmic parameter used to introduce, and eventually verify, hidden patterns or markers in the model's generated text. The key ensures that only authorized parties (e.g., model developers or researchers) can embed or detect the watermark. Secret key 112 may be used to influence the text-generation process by altering the probabilities of certain tokens during output generation. This ensures the generated text contains a unique pattern that is difficult to replicate without access to the key 112. The same secret key 112 may be required to identify or validate the watermark in the text. This ensures that only those with the key 112 or access to a unique partitioning generated using the key 112 can confirm the content was generated by the model. Watermarking module 104 comprises one or more software programs configured to, when executed, generate watermarked text 118 based on an LM prompt 114. LMprompt 114 refers to the input text provided to the language model to generate a response or perform a task. Prompt 114 acts as an instruction for the model for the content, style, and focus of its output. Watermark detection module 106 comprises one or more software programs configured to, when executed, generate a watermark detection result 119 indicating whether a set of text 116 is watermarked text.

[0052] The process of partitioning the vocabulary of LM 120 to produce LM vocabulary subsets 110A and 1 IB and exempt vocabulary 110C is described in the following section.

[0053] II. Language Model Vocabulary Partitioning

[0054] FIG. 2 is a block diagram illustrating a vocabulary partitioning module 102, and FIG. 5 is a flowchart illustrating a process 500 for partitioning a language module vocabulary, according to some embodiments of the technology described herein. LM vocabulary 200 (FIG. 2) represents the vocabulary of LM 120. LM vocabulary 200 represents the set of all possible tokens (e.g., sentences, words, subwords, characters, or even byte-level units, depending on the tokenization method) that LM 120 recognizes and uses during text generation and processing. These tokens serve as the fundamental building blocks for the model to understand and generate text. In this example, LM vocabulary 200 includes tokens 202A, 202B, 202C, 202D, 202E, 202F, etc. However, LM vocabulary 200 may include any suitable number of tokens. At step 502 (FIG. 5), LM vocabulary partitioning module 102 accesses LM vocabulary 200, including the tokens depicted in FIG. 2. Optionally, at step 504, LM vocabulary partitioning module 102 filters the most frequently used tokens (or at least some of the most frequently used tokens) from LM vocabulary 200 to obtain a filtered vocabulary. For example, words that may be omitted from the filtered vocabulary include articles such as “a,” “an” and “the” and / or particles such as “on,” “off, “in,” “up,” “out,” and “at” and / or pronouns such as “he,” “she, “it,” “my,” “your,” and “her” and / or conjunctions such as “and,” “but, “or,” “because,” “although,” and “either.” Tokens omitted from the filtered vocabulary are assigned to exempt vocabulary HOC of FIG. 2. Accordingly, exempt vocabulary HOC serves as the white list defined above.

[0055] At step 506, LM vocabulary partitioning module 102 computes hash values for the tokens in the vocabulary using a secret key H(K). The hash values may include fixed-length strings of characters, e.g., as a sequence of numbers and letters, generated by a hash function. Each hash value may serve as a unique digital fingerprint for a token. At step 508, LM vocabulary partitioning module 102 assigns each token either to vocabulary subset 110A or to vocabularysubset HOB using a hash. In embodiments in which the vocabulary is filtered (at step 504), only tokens that have not been omitted from the vocabulary are ultimately hashed and assigned to subset 110A or 110B (e.g., into a red list or a green list). In the example of FIG. 2, token 202A is hashed using hash 204A, token 202B is hashed using hash 204B, token 202D is hashed using hash 204D and token 202F is hashed using hash 204F. Tokens 202B and 202D are assigned to subset HOB, which in this case serves as the green list, and tokens 202A and 202F are assigned to subset 110 A, which in this case serves as the red list.

[0056] In some embodiments, assigning tokens to LM vocabulary subset 110A using the corresponding hash values involves converting the hash value computed for a token into an integer value, and computing a value of the integer value modulo 2. In these embodiments, determining whether to assign the token to the LM vocabulary subset 100A is performed using the value of the integer modulo 2.

[0057] III. Text Watermarking

[0058] FIG. 3 is a block diagram illustrating a watermarking module 104, and FIG. 6 is a flowchart illustrating a process 600 for outputting watermarked text, according to some embodiments of the technology described herein. Watermarking module 104 comprises one or more software programs configured to, when executed, generate watermarked text 118 based on a LM prompt 114. As can be appreciated from FIGs. 3 and 6, the process of generating watermarked text 118 is performed recursively. Watermarking module 104 includes token sampling module 104A and watermarked text generation module 104B, as shown in FIG. 3.

[0059] At step 602 (FIG. 6), watermarking module 104 obtains a vocabulary subset that has been previously partitioned from a language model’s vocabulary. For example, watermarking module 104 may obtain LM vocabulary subset 110A, described above in connection with FIG. 2. At step 604, token sampling module 104A prompts LM 120 to obtain an output 314 indicating one or more candidate tokens and corresponding probabilities. LM 120 generates output 314 by performing a sampling step, in which LM 120 outputs an indication of the candidate token(s) and corresponding probabilities based on the probability distribution generated by the model. In some embodiments, token sampling module 104A prompts LM 120 by providing an input query (e.g., a textual query) to LM 120. The input query may be processed using parameters of the LM 120 to generate the output 314.In the first iteration, input 312 is generated primarily based on LM prompt 114 (and optionally based on other user-defined parameters such as temperature). In the following iterations, the input provided by token sampling module 104A to LM 120 is generated in part based on LM prompt 114 and in part based on the output of the previous iteration. Output 314 indicates candidate token(s) and corresponding probabilities. The probability corresponding to a candidate token represents the likelihood that the token is the next part of the output, given the preceding context. A high probability indicates that the candidate token is highly likely to appear next based on the context while a low probability indicates that the candidate token is less likely to appear. A token produced at step 604 is said to be “candidate” in that whether it is ultimately used as the output token will be determined in the following steps of process 600.

[0060] At step 606, token sampling module 104A determines an output token. The token sampling module 104A may determine the output token by: (1) determining if the candidate token(s) obtained at step 604 belong to LM vocabulary subset 110A (step 606A), and (2) determining the output token based on whether the candidate token(s) belong to the LM vocabulary subset 110A (step 606B). For example, token sampling module 104A may determine whether the candidate token(s) have a matching token in subset 110A.

[0061] Step 606B, in which token sampling module 104A determines the output token based on whether candidate token(s) belongs to LM vocabulary subset 110A, may be performed in various ways. In some embodiments, this can be performed on the basis of the top probabilities among the candidate token(s) produced by LM 120. In this example, output 314 includes a plurality of candidate tokens and a plurality of probabilities, each being associated with a respective token. In some embodiments, the candidate tokens are selected on the basis of their probabilities. For example, only the candidate tokens having the n top probabilities may be chosen (where n may be between 5 and 50, between 5 and 40, between 5 and 30, between 5 and 20, or between 5 and 10, for example). If it is determined at step 606A that a candidate token belongs to the vocabulary subset 110A, at step 606B token sampling module 104A adjusts (e.g., reduces) the probability corresponding to the candidate token to obtain an adjusted plurality of probabilities and samples the output token from the plurality of candidate tokens using the adjusted plurality of probabilities.

[0062] In some embodiments, determining the output token at step 606B based on whether the candidate token(s) belongs to LM vocabulary subset 110A may be performed using rejection sampling, a statistical method used to generate samples from a target probability distribution, candidate token(s) obtained at step 604 may consist of one candidate token. The token samplingmodule 104A may be configured to perform rejection sampling when it is determined that the candidate token belongs to LM vocabulary subset 110A. The token sampling module 104 may adjust the probability associated with words in LM vocabulary subset 110A according to the target probability distribution. The method involves sampling from a simpler proposal distribution and using a criterion to reject or accept a sample based on the desired target distribution. For example, performing rejection sampling to determine the output token may involve sampling a test value based on a target probability distribution, comparing the probability corresponding to the candidate token obtained at step 604 to the test value, and determining whether to reject or accept the candidate token based on a result of comparing the probability to the test value. When it is determined to reject the candidate token, the method further involves providing the input to the language model to obtain another candidate token and a corresponding probability. As indicated by the dashed loop shown in the block of FIG. 6 corresponding to step 606B, token sampling module 104 may perform multiple iterations of sampling a candidate token and performing rejection sampling (e.g., after each iteration in which a sampled candidate token belongs to LM vocabulary subset 110A and is rejected when performing rejection sampling, token sampling module 606B may perform another iteration). By contrast, when it is determined that the candidate token obtained at step 604 does not belong to LM vocabulary subset 110A, token sampling module 104 may determine the candidate token to be the output token.

[0063] In some embodiments, the output token determined at step 606 is removed from LM vocabulary subset 110A. This step - referred to as “clearing” - provides provable guarantees of a false-positive error rate on text, especially on texts with repetitive vocabulary. Clearing also preserves performance, text quality, and robustness relative to conventional techniques.

[0064] At step 608, watermarked text generation module 104B generates watermarked text 118 using output token 316 (regardless of which token was selected to serve as the output token). At step 610, watermarking module 104 determines whether the input processing has been completed. For example, watermarking module 104 ma determine whether watermarked text 118 is complete. If it is determined that watermarked text 118 is complete, watermarking module 104 outputs watermarked text 118 in the current form (step 612). However, if it is determined that watermarked text 118 is not complete, process 600 performs an additional iteration. In the following iteration, watermarked text generation module 104B generates subsequent input 318, which token sampling module 104A uses to provide a new input 312 to LM 120. Subsequent input 318 is derived from(e.g., is a copy of) output token 316. Following each additional iteration, watermarked text 118 is updated (e.g., the current token is appended to the existing text).

[0065] IV. Detection of Watermarks

[0066] FIG. 4 is a block diagram illustrating a watermark detection module 106, and FIG. 7 is a flowchart illustrating a process 700 for detecting a watermark, according to some embodiments of the technology described herein. Watermark detection module 106 is configured to determine whether input text is watermarked (e.g., to determine whether the text was generated by a particular language model). As shown in FIG. 4, watermark detection module 106 includes a tokenization module 106A and a watermark testing module 106B. At step 702 (FIG. 7), watermark detection module 106 obtains vocabulary subsets that have been previously partitioned from a language model’s vocabulary. For example, watermarking detection module 106 may obtain LM vocabulary subsets 110A and HOB, described above in connection with FIG. 2.

[0067] At step 704, tokenization module 106 A tokenizes input text to obtain a set of tokens representing the input text. In the example of FIG. 4, tokenization module 106 A tokenizes a set of text 116 to obtain tokens ti, t2, ts, , etc. Tokenization is the process by which module 106 breaks down text into smaller units, i.e., the tokens.

[0068] At step 706, watermark testing module 106B determines the number of tokens present in the set obtained at step 704 that belong to subset 110A and the number of tokens that belong to set 110B. In some embodiments, step 704 is performed on the basis of unique tokens. For example, watermark testing module 106B may determine the number of unique tokens present in the set obtained at step 704 that belong to subset 110A and the number of unique tokens that belong to set HOB. At step 708, watermark testing module 106B determines whether the text is watermarked using the number of tokens (or unique tokens) in the set that belong to subset 110A and the number of tokens (or unique tokens) in the set of that belong to subset 110B. Watermark detection result 119 indicates whether txt 116 is watermarked.

[0069] In some embodiments, process 700 further involves determining the expected number of tokens in the text that belong to LM vocabulary subset 110A based on a ratio of the number of tokens in LM vocabulary subset 110A to the total number of tokens in LM vocabulary subset 110A and in LM vocabulary subset 110B. In these embodiments, determining whether the text is watermarked is performed based on the expected number of tokens that belong to LM vocabulary subset 110A. In some embodiments, process 700 further involves performing a binomial test toobtain a p-value using the number of tokens that belong to LM vocabulary subset 100A, the number of tokens that belong to LM vocabulary subset HOB, and the expected number of tokens in the text that belong to LM vocabulary subset 110A. In these embodiments, determining whether the text is watermarked is performed based on the p-value. An example of a binomial test is described in the section titled “statistical test.”

[0070] V. Statistical Test

[0071] This section describes an illustrative statistical test that may be performed as part of process 700. For each document being considered, given a secret key k, one can compute a likelihood by evaluating the h value of the collection of words appearing in the document. This is described herein in the special case where h takes two values. For simplicity it will also be assumed that the hash function h has equal likelihood for the two values 0 and a.

[0072] The LLM’s vocabulary may be partitioned into three sets: a white list (“W”), a red list (“R”) and a green list (“G”). The words in G have a h value of 0 - these are the words that are not rejected. The words in R have a non-zero rejection probability. T denotes the set of tokens that appear in the document at least once. If the document was not generated using the watermark with key k, then each word in T \ W is equally likely to be in R and in G.

[0073] A simple statistical test may be performed using a binomial test. Let n denote the number of unique token words in T \ W and let m denote the number of unique token words in T Cl G. The document is identified as watermarked if:

[0074]

[0075] where <b represents a probability threshold. A typical setting for d> is 0.05. However, for greater certainty, smaller values can be selected for <b.

[0076] VI. Illustrative Example

[0077] Suppose an LLM receives the prompt: “how complex is a patent application?” Given a secret key k, the LLM’s vocabulary may be partitioned into three sets: a white list (“W”), a red list (“R”) and a green list (“G”). Here, W contains the most popular words and may include for example the words “a,” “the,” “is,” etc. The R and G may partition the remaining words randomly.For example, R may include the words “complex” and “patent” while G may include the word “application.” First, we illustrate how the evaluation would take place on text generated by a model other than the LLM of interest. The text generated using this other model is the following:

[0078] To obtain the grant of a patent, a person, either legal or natural, must file

[0079] an application at a patent office with the jurisdiction to grant a patent in the geographic area over which coverage is required.

[0080] In this text, R includes the words “obtain,” “patent,” “legal,” “jurisdiction,” “geographic,” “coverage” and “required” (7 words) and G includes “grant,” “file” and “application” (3 words). Therefore, the detection procedure may produce the following score:

[0081]

[0082] Because the result is large (e.g., greater than 0.5), the text will be rejected from being watermarked.

[0083] In accordance with the techniques described herein, the word “obtain” may be replaced with the word “get,” the word “legal” may be replaced with the word “statutory,” the word “geographic” may be replaced with the word “state” or “country,” and the word “jurisdiction” may be replaced with the word “authority.” Further, the language “coverage is required” may be replaced with the language “scope is requested.” In this example, G further includes the words “get,” “statutory,” “state” (or “country”), “scope” and “requested.” The text generated using the LLM of interest is the following:

[0084] To get the grant of a patent, a person, either statutory or natural, must file

[0085] an application at a patent office with the authority to grant a patent in the

[0086] state or country over which the patent scope is requested.

[0087] In this text, R includes 1 word and G includes 11 words. Therefore, the detection procedure may produce the following score:

[0088]

[0089] As a result, for high or moderately large thresholds, the text will be identified as watermarked without significantly impacting the quality of the text.

[0090] VII. Implementation Details

[0091] FIG. 8 shows a block diagram of an exemplary computing device 800 that may be specially configured to implement some embodiments of the technology described herein. For example, the computing device 800 may be configured to implement language model 120, LM vocabulary partitioning module 102, watermarking module 104, watermark detection module, and the submodules included within those modules.

[0092] The computer system 800 may include one or more computer hardware processors 802 and non-transitory computer-readable storage media (e.g., memory 804 and one or more nonvolatile storage 804). The processor(s) 802 may control writing data to and reading data from (1) the memory 804; and (2) the non-volatile storage device(s) 806. To perform any of the functionality described herein, the processor(s) 802 may execute one or more processorexecutable instructions stored in one or more non-transitory computer-readable storage media (e.g., the memory 804), which may serve as non-transitory computer-readable storage media storing processor-executable instructions for execution by the processor(s) 802.

[0093] The terms “program” or “software” are used herein in a generic sense to refer to any type of computer code or set of processor-executable instructions that can be employed to program a computer or other processor (physical or virtual) to implement various aspects of embodiments as discussed above. Additionally, according to one aspect, one or more computer programs that when executed perform methods of the disclosure provided herein need not reside on a single computer or processor, but may be distributed in a modular fashion among different computers or processors to implement various aspects of the disclosure provided herein.

[0094] Processor-executable instructions may be in many forms, such as program modules, executed by one or more computers or other devices. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform tasks or implementabstract data types. Typically, the functionality of the program modules may be combined or distributed.

[0095] Various inventive concepts may be embodied as one or more processes, of which examples have been provided. The steps performed as part of each process may be ordered in any suitable way. Thus, embodiments may be constructed in which steps are performed in an order different than illustrated, which may include performing some steps simultaneously, even though shown as sequential steps in illustrative embodiments.

[0096] As used herein in the specification and in the claims, the phrase “at least one,” in reference to a list of one or more elements, should be understood to mean at least one element selected from any one or more of the elements in the list of elements, but not necessarily including at least one of each and every element specifically listed within the list of elements and not excluding any combinations of elements in the list of elements. This definition also allows that elements may optionally be present other than the elements specifically identified within the list of elements to which the phrase “at least one” refers, whether related or unrelated to those elements specifically identified. Thus, for example, “at least one of A and B” (or, equivalently, “at least one of A or B,” or, equivalently “at least one of A and / or B”) can refer, in one embodiment, to at least one, optionally including more than one, A, with no B present (and optionally including elements other than B); in another embodiment, to at least one, optionally including more than one, B, with no A present (and optionally including elements other than A); in yet another embodiment, to at least one, optionally including more than one, A, and at least one, optionally including more than one, B (and optionally including other elements) ;etc.

[0097] The phrase “and / or,” as used herein in the specification and in the claims, should be understood to mean “either or both” of the elements so conjoined, i.e., elements that are conjunctively present in some cases and disjunctively present in other cases. Multiple elements listed with “and / or” should be construed in the same fashion, i.e., “one or more” of the elements so conjoined. Other elements may optionally be present other than the elements specifically identified by the “and / or” clause, whether related or unrelated to those elements specifically identified. Thus, as a non-limiting example, a reference to “A and / or B”, when used in conjunction with open-ended language such as “comprising” can refer, in one embodiment, to A only (optionally including elements other than B); in another embodiment, to B only (optionally including elements other than A); in yet another embodiment, to both A and B (optionally including other elements); etc.Use of ordinal terms such as “first,” “second,” “third,” etc., in the claims to modify a claim element does not by itself connote any priority, precedence, or order of one claim element over another or the temporal order in which steps of a method are performed. Such terms are used merely as labels to distinguish one claim element having a certain name from another element having a same name (but for use of the ordinal term). The phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. The use of “including,” “comprising,” “having,” “containing,” “involving,” and variations thereof, is meant to encompass the items listed thereafter and additional items.

[0098] Having described several embodiments of the techniques described herein in detail, various modifications, and improvements will readily occur to those skilled in the art. Such modifications and improvements are intended to be within the spirit and scope of the disclosure. Accordingly, the foregoing description is by way of example only, and is not intended as limiting. The techniques are limited only as defined by the following claims and the equivalents thereto.

Claims

What is claimed is:CLAIMS1. A method for watermarking text generated using a language model such that the text can be confirmed as being generated by the language model, the language model having a vocabulary, the method comprising:using a computer hardware processor to perform:obtaining a first vocabulary subset of the language model’s vocabulary, the first vocabulary subset partitioned from the language model’s vocabulary using a secret key;processing input to the language model to generate a set of watermarked text at least in part by:providing the input to the language model to obtain an output indicating a candidate token and a corresponding probability;determining, using the candidate token and the first vocabulary subset of the language model’s vocabulary, an output token from which to generate the set of watermarked text at least in part by:determining whether the candidate token belongs to the first vocabulary subset of the language model’s vocabulary;determining the output token based on a determination of whether the candidate token belongs to the first vocabulary subset; and generating the set of watermarked text using the output token.

2. The method of claim 1, wherein:the output of the language model indicates a plurality of probabilities corresponding to a plurality of candidate tokens, the plurality of candidate tokens including the candidate token; anddetermining the output token based on the determination of whether the candidate token belongs to the first vocabulary subset comprises:if it is determined that the candidate token belongs to the first vocabulary subset, adjusting the probability corresponding to the candidate token to obtain an adjusted plurality of probabilities; andsampling the output token from the plurality of candidate tokens using the adjusted plurality of probabilities.

3. The method of claim 1, wherein determining the output token based on the determination of whether the candidate token belongs to the first vocabulary subset comprises:if it is determined that the candidate token belongs to the first vocabulary subset, performing rejection sampling to obtain the output token.

4. The method of claim 3, wherein performing rejection sampling to obtain the output token comprises:sampling a test value based on a target probability distribution;comparing the probability corresponding to the candidate token to the test value; determining whether to reject or accept the candidate token based on a result of comparing the probability to the test value;when it is determined to reject the candidate token, providing the input to the language model to obtain another candidate token and a corresponding probability; andwhen it is determined to accept the candidate token, using the candidate token as the output token.

5. The method of claim 1, wherein determining the output token based on the determination of whether the candidate token belongs to the first vocabulary subset comprises:if it is determined that the candidate token does not belong to the first vocabulary subset, using the candidate token as the output token.

6. The method of claim 1, wherein processing the input to the language model to generate the set of watermarked text further comprises:if it is determined that the candidate token belongs to the first vocabulary subset, removing the first token from the first vocabulary subset to obtain an updated first vocabulary subset.

7. The method of claim 6, wherein processing the input to the language model to generate the set of watermarked text further comprises:after obtaining the output token:generating a second input to the language model using the output token; providing the second input to the language model to obtain a second candidate token and a corresponding second probability;determining, using the second candidate token and the updated first vocabulary subset, a second output token from which to generate the set of watermarked text; and generating the set of watermarked text using the second output token.

8. The method of claim 1, further comprising partitioning the language model’s vocabulary to obtain the first vocabulary subset using the secret key.

9. The method of claim 8, wherein partitioning the language model’s vocabulary to obtain the first vocabulary subset comprises:computing, using the secret key, hash values for a plurality of tokens in the language model’s vocabulary; andassigning a subset of the plurality of tokens to the first vocabulary subset using the hash values computed for the plurality of tokens.

10. The method of claim 9, wherein assigning the subset of the plurality of tokens to the first vocabulary subset using the hash values computed for the plurality of tokens comprises:for each of at least some of the plurality of tokens:converting a hash value computed for the token into an integer value; computing a value of the integer value modulo 2; anddetermining whether to assign the token to the first vocabulary subset using the value of the integer value modulo 2.

11. The method of claim 8, wherein partitioning the language model’s vocabulary to obtain the first vocabulary subset comprises:identifying tokens of the language model’s vocabulary representing strings that most frequently appear in text from which the language model’s vocabulary is derived;filtering out the identified tokens from the language model’s vocabulary to obtain a filtered vocabulary; andpartitioning the first vocabulary subset from the filtered vocabulary.

12. A method for verifying whether text was generated by a language model by detecting whether the text is watermarked text, the language model having a vocabulary, the method comprising:using a computer hardware processor to perform:obtaining a first vocabulary subset and a second vocabulary subset of the language model’s vocabulary, the first vocabulary subset and the second vocabulary subset partitioned from the language model’s vocabulary using a secret key;tokenizing the text to obtain a set of tokens from the language model’s vocabulary representing the text;determining a number of tokens in the set of tokens that belong to the first vocabulary subset and a number of tokens in the set of tokens that belong to the second vocabulary subset; anddetermining whether the text is watermarked using the number of tokens in the set of tokens that belong to the first vocabulary subset and the number of tokens in the set of tokens that belong to the second vocabulary subset.

13. The method of claim 12, wherein:determining the number of tokens in the set of tokens that belong to the first vocabulary subset comprises determining a number of unique tokens in the set of tokens that belong to the first vocabulary subset; anddetermining the number of tokens in the set of tokens that belong to the second vocabulary subset comprises determining a number of unique tokens in the set of tokens that belong to the second vocabulary subset.

14. The method of claim 12, wherein determining whether the text is watermarked comprises:determining an expected number of tokens in the text that belong to the first vocabulary subset based on a ratio of a number of tokens in the first vocabulary subset to a total number of tokens in the first vocabulary subset and the second vocabulary subset; anddetermining whether the text is watermarked based on the expected number of tokens that belong to the first vocabulary subset.

15. The method of claim 14, wherein determining whether the text is watermarked based on the expected number of tokens that belong to the first vocabulary subset and the number of tokens comprises:performing a binomial test to obtain a p-value using the number of tokens in the set of tokens that belong to the first vocabulary subset, the number of tokens in the set of tokens that belong to the second vocabulary subset, and the expected number of tokens in the text that belong to the first vocabulary subset; anddetermining whether the text is watermarked based on the p-value.

16. The method of claim 12, further comprising partitioning the language model’s vocabulary to obtain the first vocabulary subset and the second vocabulary subset using the secret key.

17. The method of claim 16, wherein partitioning the language model’s vocabulary to obtain the first vocabulary subset and the second vocabulary subset comprises:computing, using the secret key, hash values for the plurality of tokens; and assigning, using the hash values computed for the plurality of tokens:a first subset of the plurality of tokens to the first vocabulary subset; and a second subset of the plurality of tokens to the second vocabulary subset.

18. The method of claim 16, wherein partitioning the language model’s vocabulary to obtain the first vocabulary subset and the second vocabulary subset comprises:identifying tokens of the language model’s vocabulary representing values that most frequently appear in text from which the language model’s vocabulary is derived;filtering out the identified tokens from the language model’s vocabulary to obtain a filtered vocabulary; andpartitioning the first vocabulary subset and the second vocabulary subset from the filtered vocabulary.

19. A system for watermarking text generated using a language model such that the text can be confirmed as being generated by the language model, the language model having a vocabulary, the system comprising:a computer hardware processor; anda non-transitory computer-readable storage medium storing instructions that, when executed by the computer hardware processor, cause the computer hardware processor to:obtain a first vocabulary subset of the language model’s vocabulary, the first vocabulary subset partitioned from the language model’s vocabulary using a secret key;process input to the language model to generate a set of watermarked text at least in part by:provide the input to the language model to obtain an output indicating a candidate token and a corresponding probability;determine, using the candidate token and the first vocabulary subset of the language model’s vocabulary, an output token from which to generate the set of watermarked text at least in part by:determine whether the candidate token belongs to the first vocabulary subset of the language model’s vocabulary;determine the output token based on a determination of whether the candidate token belongs to the first vocabulary subset; and generate the set of watermarked text using the output token.

20. A non-transitory computer-readable storage medium storing instructions that, when executed by a computer hardware processor, cause the computer hardware processor to perform a method for watermarking text generated using a language model such that the text can be confirmed as being generated by the language model, the language model having a vocabulary, the method comprising:obtaining a first vocabulary subset of the language model’s vocabulary, the first vocabulary subset partitioned from the language model’s vocabulary using a secret key;processing input to the language model to generate a set of watermarked text at least in part by:providing the input to the language model to obtain an output indicating a candidate token and a corresponding probability;determining, using the candidate token and the first vocabulary subset of the language model’s vocabulary, an output token from which to generate the set of watermarked text at least in part by:determining whether the candidate token belongs to the first vocabulary subset of the language model’s vocabulary;determining the output token based on a determination of whether the candidate token belongs to the first vocabulary subset; andgenerating the set of watermarked text using the output token.

21. A system for verifying whether text was generated by a language model by detecting whether the text is watermarked text, the system comprising:a computer hardware processor; anda non-transitory computer-readable storage medium storing instructions that, when executed by the computer hardware processor, cause the computer hardware processor to:obtain a first vocabulary subset and a second vocabulary subset of the language model’s vocabulary, the first vocabulary subset and the second vocabulary subset partitioned from the language model’s vocabulary using a secret key;tokenize the text to obtain a set of tokens from the language model’s vocabulary representing the text;determine a number of tokens in the set of tokens that belong to the first vocabulary subset and a number of tokens in the set of tokens that belong to the second vocabulary subset; anddetermine whether the text is watermarked using the number of tokens in the set of tokens that belong to the first vocabulary subset and the number of tokens in the set of tokens that belong to the second vocabulary subset.

22. A non-transitory computer-readable storage medium storing instructions that, when executed by a computer hardware processor, cause the computer hardware processor to perform a method for verifying whether text was generated by a language model by detecting whether the text is watermarked text, the language model having a vocabulary, the method comprising:obtaining a first vocabulary subset and a second vocabulary subset of the language model’s vocabulary, the first vocabulary subset and the second vocabulary subset partitioned from the language model’s vocabulary using a secret key;tokenizing the text to obtain a set of tokens from the language model’s vocabulary representing the text;determining a number of tokens in the set of tokens that belong to the first vocabulary subset and a number of tokens in the set of tokens that belong to the second vocabulary subset; anddetermining whether the text is watermarked using the number of tokens in the set of tokens that belong to the first vocabulary subset and the number of tokens in the set of tokens that belong to the second vocabulary subset.

Images