LLM Watermarking via Token Probability Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing watermarking techniques for large language models (LLMs) are inefficient, often requiring access to internal parameters, are prone to evasion through paraphrasing, and can degrade text quality, posing challenges in detecting malicious content dissemination.
Innovation Solution
A method involving inputting a sequence of tokens into an LLM, extracting a context code, combining it with a private key to generate a watermark code, and adjusting token probabilities to embed imperceptible signals, allowing detection without compromising text quality or model access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing watermarking techniques are used in LLMs, then detection capability is improved, but text quality degrades
Solution Approach 1:
The watermarking process is segmented into two independent phases: (1) embedding phase where subtle modifications are made to token probabilities during generation, and (2) detection phase where statistical analysis identifies watermarked content. This segmentation allows the embedding to remain imperceptible while the detection phase provides robust verification, resolving the contradiction between detection capability and text quality.
Solution Approach 2:
The patent changes the parameter space from direct text modification to probability distribution adjustment. By modifying the logits (probability scores) of tokens during generation rather than altering the generated text itself, the watermark remains imperceptible to humans while still being detectable through statistical analysis of the probability distributions, thus maintaining text quality while improving detection capability.
2Measurement precision
If statistical analysis methods are used for detection, then detection capability is improved, but reliability worsens due to evasion through paraphrasing
Solution Approach 1:
The watermark is embedded preliminarily during the token generation process itself, rather than as a post-processing step. By adjusting token probabilities as they are generated, the watermark becomes intrinsically tied to the content structure. This preliminary embedding ensures that even when paraphrasing occurs, the statistical patterns remain detectable because the watermark is woven into the fabric of the generation process rather than applied superficially.
Solution Approach 2:
The detection method uses feedback from the generation process by analyzing the distribution of tokens against expected patterns. The system continuously monitors token probability distributions during generation and uses this feedback to identify watermarked content. This feedback mechanism maintains reliability against paraphrasing because it detects the underlying statistical anomalies introduced during generation, not just surface-level text patterns that can be easily altered.
3Measurement precision
If watermarking techniques require access to internal parameters, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary detection mechanism that operates on the output probability distributions rather than requiring direct access to internal model parameters. The detector acts as an intermediary layer that analyzes the statistical properties of token sequences and their associated probability distributions, enabling precise detection without needing to penetrate the model's internal architecture. This intermediary approach maintains detection precision while avoiding the complexity of parameter access.
Data Source
AI summary
Systems, methods, apparatuses, and computer program products for providing and detecting watermarking in large language models (LLM). A method for watermarking a LLM may include inputting, into the LLM, a sequence of tokens conditioned on a given context to obtain an output distribution. The method may also include extracting a context code from the sequence of tokens. The method may further include generating a watermark code by combining the context code with a private key held by a service provider. In addition, the method may include adjusting, based on the watermark code, a probability of the tokens in the sequence of tokens. Further, the method may include sampling a watermarked output from a distribution of the sequence of tokens based on the adjustment and the context code.