Signature vs. Substance: Evaluating the Balance of Adversarial Resistance and Linguistic Quality in Watermarking Large Language Models

TL;DR

This paper evaluates watermarking techniques for LLM-generated text, analyzing their robustness against attacks and their impact on text quality and style, revealing vulnerabilities and trade-offs involved.

Contribution

It provides a comprehensive assessment of watermarking robustness and quality preservation, highlighting the challenges and limitations in current methods.

Findings

Watermarking techniques preserve semantics but alter writing style.

Back translation attacks are particularly effective against watermarking.

Watermarking methods are vulnerable to adversarial attacks, reducing detection reliability.

Abstract

To mitigate the potential harms of Large Language Models (LLMs)generated text, researchers have proposed watermarking, a process of embedding detectable signals within text. With watermarking, we can always accurately detect LLM-generated texts. However, recent findings suggest that these techniques often negatively affect the quality of the generated texts, and adversarial attacks can strip the watermarking signals, causing the texts to possibly evade detection. These findings have created resistance in the wide adoption of watermarking by LLM creators. Finally, to encourage adoption, we evaluate the robustness of several watermarking techniques to adversarial attacks by comparing paraphrasing and back translation (i.e., English $\to$ another language $\to$ English) attacks; and their ability to preserve quality and writing style of the unwatermarked texts by using linguistic metrics to capture quality and writing style of texts. Our results suggest that these watermarking techniques preserve semantics, deviate from the writing style of the unwatermarked texts, and are susceptible to adversarial attacks, especially for the back translation attack.