Black-Box Detection of Language Model Watermarks

TL;DR

This paper develops statistical tests to detect and analyze the presence of watermarking in language models in black-box settings, revealing that current watermarking schemes are more detectable than previously thought.

Contribution

It introduces the first rigorous black-box detection methods for multiple watermarking schemes, demonstrating their effectiveness on various models and real-world APIs.

Findings

Watermarking schemes are more detectable than previously believed.

Effective statistical tests can identify watermark presence with limited queries.

Detection methods work on open-source models and real-world APIs.

Abstract

Watermarking has emerged as a promising way to detect LLM-generated text, by augmenting LLM generations with later detectable signals. Recent work has proposed multiple families of watermarking schemes, several of which focus on preserving the LLM distribution. This distribution-preservation property is motivated by the fact that it is a tractable proxy for retaining LLM capabilities, as well as the inherently implied undetectability of the watermark by downstream users. Yet, despite much discourse around undetectability, no prior work has investigated the practical detectability of any of the current watermarking schemes in a realistic black-box setting. In this work we tackle this for the first time, developing rigorous statistical tests to detect the presence, and estimate parameters, of all three popular watermarking scheme families, using only a limited number of black-box queries. We experimentally confirm the effectiveness of our methods on a range of schemes and a diverse set of open-source models. Further, we validate the feasibility of our tests on real-world APIs. Our findings indicate that current watermarking schemes are more detectable than previously believed.