mlsanityData to 7 Oct 2026

Protecting Language Generation Models via Invisible Watermarking

arXiv 2302.03162 ↗First posted 6 Feb 2023cs.CR cs.CL cs.LGcited by 81

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Language generation models have been an increasingly powerful enabler for many applications. Many such models offer free or affordable API access, which makes them potentially vulnerable to model extraction attacks through distillation. To protect intellectual property (IP) and ensure fair use of these models, various techniques such as lexical watermarking and synonym replacement have been proposed. However, these methods can be nullified by obvious countermeasures such as "synonym randomization". To address this issue, we propose GINSEW, a novel method to protect text generation models from being stolen through distillation. The key idea of our method is to inject secret signals into the probability vector of the decoding steps for each target token. We can then detect the secret message by probing a suspect model to tell if it is distilled from the protected one. Experimental results show that GINSEW can effectively identify instances of IP infringement with minimal impact on the generation quality of protected APIs. Our method demonstrates an absolute improvement of 19 to 29 points on mean average precision (mAP) in detecting suspects compared to previous methods against watermark removal attacks.

Key facts. Cited by 81 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 27 of its 38 references that are in the map. First posted on arXiv 6 Feb 2023.

Builds on

27 of 38 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022Distillation-Resistant Watermarking for Model Protection in NLP7 Oct
  2. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarks19 Sep
  3. 2022Cosine Model Watermarking Against Ensemble Distillation5 Mar
  4. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermark5 Dec

Other references · 23

  1. 2017Attention Is All You Needcited by 59,932
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2020Language Models are Few-Shot Learnerscited by 32,199
  4. 2022Training language models to follow instructions with human feedbackcited by 15,712
  5. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  6. 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,874
  7. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  8. 2013Efficient Estimation of Word Representations in Vector Spacecited by 4,346
  9. 2015Neural Machine Translation of Rare Words with Subword Unitscited by 2,898
  10. 2019fairseq: A Fast, Extensible Toolkit for Sequence Modelingcited by 1,486
  11. 2020Multilingual Denoising Pre-training for Neural Machine Translationcited by 1,028
  12. 2016Stealing Machine Learning Models via Prediction APIscited by 602
11 more
  1. 2017Convolutional Sequence to Sequence Learningcited by 550
  2. 2016A Corpus and Evaluation Framework for Deeper Understanding of Commonsense Storiescited by 413
  3. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  4. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  5. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  6. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  7. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  8. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  9. 2020Imitation Attacks and Defenses for Black-box Machine Translation Systemscited by 78
  10. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 51
  11. 2021Student Surpasses Teacher: Imitation Attack for Black-Box NLP APIscited by 16

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 23; 2024: 29; 2025: 23; 2026: 6.

81 papers.

Sort:

By area:

  1. 2023Can AI-Generated Text be Reliably Detected?cited by 372
  2. 2023Robust Distortion-free Watermarks for Language Modelscited by 279
  3. 2023Provable Robust Watermarking for AI-Generated Textcited by 259
  4. 2023DetectLLM: Leveraging Log Rank Information for Zero-Shot Detection of Machine-Generated Textcited by 207
  5. 2023MAGE: Machine-generated Text Detection in the Wildcited by 130
  6. 2023M4: Multi-generator, Multi-domain, and Multi-lingual Black-Box Machine-Generated Text Detectioncited by 118
  7. 2024Mapping the Increasing Use of LLMs in Scientific Paperscited by 112
  8. 2023A Survey of Text Watermarking in the Era of Large Language Modelscited by 102
  9. 2023Identifying and Mitigating the Security Risks of Generative AIcited by 90
  10. 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 89
  11. 2023Three Bricks to Consolidate Watermarks for Large Language Modelscited by 80
  12. 2024Watermark Stealing in Large Language Modelscited by 79
38 more
  1. 2023On the Learnability of Watermarks for Language Modelscited by 72
  2. 2023A Survey on Detection of LLMs-Generated Contentcited by 70
  3. 2023REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Modelscited by 64
  4. 2024Instructional Fingerprinting of Large Language Modelscited by 64
  5. 2023Mark My Words: Analyzing and Evaluating Language Model Watermarkscited by 62
  6. 2023Red Teaming Language Model Detectors with Language Modelscited by 55
  7. 2024Watermarking Makes Language Models Radioactivecited by 52
  8. 2023Watermarking Conditional Text Generation for AI Detection: Unveiling Challenges and a Semantic-Aware Watermark Remedycited by 45
  9. 2024M4GT-Bench: Evaluation Benchmark for Black-Box Machine-Generated Text Detectioncited by 43
  10. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  11. 2023Fighting Fire with Fire: Can ChatGPT Detect AI-generated Text?cited by 39
  12. 2023Anatomy of an AI-powered malicious social botnetcited by 35
  13. 2024REEF: Representation Encoding Fingerprints for Large Language Modelscited by 34
  14. 2023Towards Possibilities & Impossibilities of AI-generated Text Detection: A Surveycited by 28
  15. 2023Bot or Human? Detecting ChatGPT Imposters with A Single Questioncited by 25
  16. 2025Antidistillation Samplingcited by 24
  17. 2023Embarrassingly Simple Text Watermarkscited by 23
  18. 2024Watermarking Techniques for Large Language Models: A Surveycited by 20
  19. 2025BiMark: Unbiased Multilayer Watermarking for Large Language Modelscited by 18
  20. 2024Permute-and-Flip: An optimally stable and watermarkable decoder for LLMscited by 17
  21. 2023Deep Intellectual Property Protection: A Surveycited by 16
  22. 2023Necessary and Sufficient Watermark for Large Language Modelscited by 16
  23. 2025Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation?cited by 16
  24. 2024LLM Whisperer: An Inconspicuous Attack to Bias LLM Responsescited by 15
  25. 2024Ward: Provable RAG Dataset Inference via LLM Watermarkscited by 15
  26. 2024Waterfall: Framework for Robust and Scalable Text Watermarking and Provenance for LLMscited by 14
  27. 2024Glimpse: Enabling White-Box Methods to Use Proprietary Models for Zero-Shot LLM-Generated Text Detectioncited by 14
  28. 2025PMark: Towards Robust and Distortion-free Semantic-level Watermarking with Channel Constraintscited by 14
  29. 2025Attack and defense techniques in large language models: A survey and new perspectivescited by 13
  30. 2025Blackbox Model Provenance via Palimpsestic Membership Inferencecited by 11
  31. 2023New Evaluation Metrics Capture Quality Degradation due to LLM Watermarkingcited by 10
  32. 2024Model Stealing for Any Low-Rank Language Modelcited by 9
  33. 2025In-Context Watermarks for Large Language Modelscited by 9
  34. 2024Topic-Based Watermarks for Large Language Modelscited by 7
  35. 2025Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoptioncited by 7
  36. 2024Watermarking Generative Tabular Datacited by 6
  37. 2025Detecting Benchmark Contamination Through Watermarkingcited by 6
  38. 2025Decoupling Content and Expression: Two-Dimensional Detection of AI-Generated Textcited by 6

50 most cited of 81 All 81 (JSON)