mlsanityData to 7 Oct 2026

Robust Distortion-free Watermarks for Language Models

arXiv 2307.15593 ↗First posted 28 Jul 2023cs.LG cs.CL cs.CRcited by 279

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

We propose a methodology for planting watermarks in text from an autoregressive language model that are robust to perturbations without changing the distribution over text up to a certain maximum generation budget. We generate watermarked text by mapping a sequence of random numbers -- which we compute using a randomized watermark key -- to a sample from the language model. To detect watermarked text, any party who knows the key can align the text to the random number sequence. We instantiate our watermark methodology with two sampling schemes: inverse transform sampling and exponential minimum sampling. We apply these watermarks to three language models -- OPT-1.3B, LLaMA-7B and Alpaca-7B -- to experimentally validate their statistical power and robustness to various paraphrasing attacks. Notably, for both the OPT-1.3B and LLaMA-7B models, we find we can reliably detect watermarked text (p ≤ 0.01) from 35 tokens even after corrupting between 40-50% of the tokens via random edits (i.e., substitutions, insertions or deletions). For the Alpaca-7B model, we conduct a case study on the feasibility of watermarking responses to typical user instructions. Due to the lower entropy of the responses, detection is more difficult: around 25% of the responses -- whose median length is around 100 tokens -- are detectable with p ≤ 0.01, and the watermark is also less robust to certain automated paraphrasing attacks we implement.

Key facts. Cited by 279 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 13 of its 29 references that are in the map. First posted on arXiv 28 Jul 2023.

Builds on

13 of 29 references.

Closest ancestors · 5

Same direction, newest first

  1. 2023Undetectable Watermarks for Language Models25 May
  2. 2023Protecting Language Generation Models via Invisible Watermarking6 Feb
  3. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarks19 Sep
  4. 2021Tracing Text Provenance via Context-Aware Lexical Substitution15 Dec
  5. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermark5 Dec

Other references · 8

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  3. 2023DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvaturecited by 705
  4. 2020Automatic Detection of Machine Generated Text: A Critical Surveycited by 160
  5. 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 121
  6. 2019Neural Linguistic Steganographycited by 73
  7. 2019Towards Near-imperceptible Steganographic Textcited by 30
  8. 2021Frustratingly Easy Edit-based Linguistic Steganography with a Masked Language Modelcited by 28

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 21; 2024: 87; 2025: 87; 2026: 84.

279 papers.

Sort:

By area:

  1. 2024Monitoring AI-Modified Content at Scale: A Case Study on the Impact of ChatGPT on AI Conference Peer Reviewscited by 160
  2. 2024Mapping the Increasing Use of LLMs in Scientific Paperscited by 112
  3. 2023A Survey of Text Watermarking in the Era of Large Language Modelscited by 102
  4. 2023A Semantic Invariant Robust Watermark for Large Language Modelscited by 97
  5. 2023Identifying and Mitigating the Security Risks of Generative AIcited by 90
  6. 2024MarkLLM: An Open-Source Toolkit for LLM Watermarkingcited by 80
  7. 2024Watermark Stealing in Large Language Modelscited by 79
  8. 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Modelscited by 77
  9. 2024Detecting Multimedia Generated by Large AI Models: A Surveycited by 73
  10. 2023On the Learnability of Watermarks for Language Modelscited by 72
  11. 2023A Survey on Detection of LLMs-Generated Contentcited by 70
  12. 2023Publicly-Detectable Watermarking for Language Modelscited by 69
38 more
  1. 2023REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Modelscited by 64
  2. 2024Instructional Fingerprinting of Large Language Modelscited by 64
  3. 2023Mark My Words: Analyzing and Evaluating Language Model Watermarkscited by 62
  4. 2024An Entropy-based Text Watermarking Detection Methodcited by 61
  5. 2024Adaptive Text Watermark for Large Language Modelscited by 60
  6. 2023An Unforgeable Publicly Verifiable Watermark for Large Language Modelscited by 54
  7. 2024Watermarking Makes Language Models Radioactivecited by 52
  8. 2023Advancing Beyond Identification: Multi-bit Watermark for Large Language Modelscited by 51
  9. 2024WaterMax: breaking the LLM watermark detectability-robustness-quality trade-offcited by 48
  10. 2023A Resilient and Accessible Distribution-Preserving Watermark for Large Language Modelscited by 47
  11. 2024No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choicescited by 47
  12. 2024k-SemStamp: A Clustering-Based Semantic Watermark for Detection of Machine-Generated Textcited by 46
  13. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  14. 2024Pseudorandom Error-Correcting Codescited by 40
  15. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
  16. 2024GumbelSoft: Diversified Language Model Watermarking via the GumbelMax-trickcited by 31
  17. 2024Token-Specific Watermarking with Enhanced Detectability and Semantic Coherence for Large Language Modelscited by 30
  18. 2023Towards Possibilities & Impossibilities of AI-generated Text Detection: A Surveycited by 28
  19. 2023WaterBench: Towards Holistic Evaluation of Watermarks for Large Language Modelscited by 27
  20. 2023Towards Optimal Statistical Watermarkingcited by 25
  21. 2024Stumbling Blocks: Stress Testing the Robustness of Machine-Generated Text Detectors Under Attackscited by 25
  22. 2024Bypassing LLM Watermarks with Color-Aware Substitutionscited by 24
  23. 2024PostMark: A Robust Blackbox Watermark for Large Language Modelscited by 24
  24. 2024Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas: A Surveycited by 23
  25. 2024Detecting AI-Generated Text: Factors Influencing Detectability with Current Methodscited by 23
  26. 2024COMPL-AI Framework: A Technical Interpretation and LLM Benchmarking Suite for the EU Artificial Intelligence Actcited by 23
  27. 2023WatME: Towards Lossless Watermarking Through Lexical Redundancycited by 22
  28. 2023Optimizing watermarks for large language modelscited by 22
  29. 2024Black-Box Detection of Language Model Watermarkscited by 22
  30. 2024Bileve: Securing Text Provenance in Large Language Models Against Spoofing with Bi-level Signaturecited by 21
  31. 2025AdaDetectGPT: Adaptive Detection of LLM-Generated Text with Statistical Guaranteescited by 20
  32. 2024Learning to Watermark LLM-generated Text via Reinforcement Learningcited by 19
  33. 2024Revisiting the Robustness of Watermarking to Paraphrasing Attackscited by 19
  34. 2025Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboardscited by 19
  35. 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuningcited by 18
  36. 2024Debiasing Watermarks for Large Language Models via Maximal Couplingcited by 18
  37. 2024Hidden in the Noise: Two-Stage Robust Watermarking for Imagescited by 18
  38. 2025BiMark: Unbiased Multilayer Watermarking for Large Language Modelscited by 18

50 most cited of 279 All 279 (JSON)