Publicly-Detectable Watermarking for Language Models

TL;DR

This paper introduces a publicly-detectable watermarking method for language models that embeds cryptographic signatures into outputs, ensuring unforgeability and undetectability, even during low-entropy periods, with practical implementation confirming theoretical claims.

Contribution

The paper proposes a novel watermarking scheme for language models that is publicly verifiable, unforgeable, and resilient to low-entropy challenges, with practical implementation.

Findings

Watermarking scheme is unforgeable and distortion-free.

The scheme is effective even during low-entropy periods.

Practical implementation confirms theoretical properties.

Abstract

We present a publicly-detectable watermarking scheme for LMs: the detection algorithm contains no secret information, and it is executable by anyone. We embed a publicly-verifiable cryptographic signature into LM output using rejection sampling and prove that this produces unforgeable and distortion-free (i.e., undetectable without access to the public key) text output. We make use of error-correction to overcome periods of low entropy, a barrier for all prior watermarking schemes. We implement our scheme and find that our formal claims are met in practice.