# Bileve: Securing Text Provenance in Large Language Models Against Spoofing with Bi-level Signature arXiv: https://arxiv.org/abs/2406.01946 · HTML: https://mlsanity.com/paper/2406.01946/ ## Key facts - Cited by 25 papers in the map (data through 14 Oct 2026). - Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. - Builds on 17 of its 24 references that are in the map. - First posted on arXiv 4 Jun 2024. ## Placed in - LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/) ## Builds on (most cited first, 17 of 17) - [LLaMA: Open and Efficient Foundation Language Models](https://mlsanity.com/paper/2302.13971/) (2023) - [OPT: Open Pre-trained Transformer Language Models](https://mlsanity.com/paper/2205.01068/) (2022) - [Pointer Sentinel Mixture Models](https://mlsanity.com/paper/1609.07843/) (2016) - [The Curious Case of Neural Text Degeneration](https://mlsanity.com/paper/1904.09751/) (2019) - [A Watermark for Large Language Models](https://mlsanity.com/paper/2301.10226/) (2023) - [Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense](https://mlsanity.com/paper/2303.13408/) (2023) - [Robust Distortion-free Watermarks for Language Models](https://mlsanity.com/paper/2307.15593/) (2023) - [Provable Robust Watermarking for AI-Generated Text](https://mlsanity.com/paper/2306.17439/) (2023) - [Undetectable Watermarks for Language Models](https://mlsanity.com/paper/2306.09194/) (2023) - [Pretrained Language Models for Text Generation: A Survey](https://mlsanity.com/paper/2201.05273/) (2022) - [Weak-to-Strong Jailbreaking on Large Language Models](https://mlsanity.com/paper/2401.17256/) (2024) - [Watermark Stealing in Large Language Models](https://mlsanity.com/paper/2402.19361/) (2024) - [On the Learnability of Watermarks for Language Models](https://mlsanity.com/paper/2312.04469/) (2023) - [Publicly-Detectable Watermarking for Language Models](https://mlsanity.com/paper/2310.18491/) (2023) - [Adaptive Text Watermark for Large Language Models](https://mlsanity.com/paper/2401.13927/) (2024) - [No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices](https://mlsanity.com/paper/2402.16187/) (2024) - [Large Language Models are Vulnerable to Bait-and-Switch Attacks for Generating Harmful Content](https://mlsanity.com/paper/2402.13926/) (2024) ## Built on by (most cited first, 25 of 25) - [SoK: Watermarking for AI-Generated Content](https://mlsanity.com/paper/2411.18479/) (2024) - [When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search](https://mlsanity.com/paper/2406.08705/) (2024) - [Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach](https://mlsanity.com/paper/2410.02890/) (2024) - [Towards Watermarking of Open-Source LLMs](https://mlsanity.com/paper/2502.10525/) (2025) - [Seven Security Challenges in Cross-domain Multi-agent LLM Systems](https://mlsanity.com/paper/2505.23847/) (2025) - [Unified attacks to large language model watermarks: spoofing and scrubbing in unauthorized knowledge distillation](https://mlsanity.com/paper/2504.17480/) (2025) - [Marking Code Without Breaking It: Code Watermarking for Detecting LLM-Generated Code](https://mlsanity.com/paper/2502.18851/) (2025) - [Discovering Spoofing Attempts on Language Model Watermarks](https://mlsanity.com/paper/2410.02693/) (2024) - [A Unified Framework for LLM Watermarks](https://mlsanity.com/paper/2602.06754/) (2026) - [A Survey of LLM × DATA](https://mlsanity.com/paper/2505.18458/) (2025) - [Mitigating Watermark Forgery in Generative Models via Randomized Key Selection](https://mlsanity.com/paper/2507.07871/) (2025) - [From Intentions to Techniques: A Comprehensive Taxonomy and Challenges in Text Watermarking for Large Language Models](https://mlsanity.com/paper/2406.11106/) (2024) - [SoK: Are Watermarks in LLMs Ready for Deployment?](https://mlsanity.com/paper/2506.05594/) (2025) - [RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resilience](https://mlsanity.com/paper/2604.11546/) (2026) - [Watermarking Should Be Treated as a Monitoring Primitive](https://mlsanity.com/paper/2605.13095/) (2026) - [SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness](https://mlsanity.com/paper/2605.25796/) (2026) - [MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarks](https://mlsanity.com/paper/2509.10766/) (2025) - [AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasing](https://mlsanity.com/paper/2605.29434/) (2026) - [LLM Watermarking as Big Data Provenance: A Deployment-Oriented Systematization](https://mlsanity.com/paper/2607.10103/) (2026) - [Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks](https://mlsanity.com/paper/2608.12713/) (2026) - [Watermark Smoothing Attacks against Language Models](https://mlsanity.com/paper/2407.14206/) (2024) - [Adaptive Testing for Segmenting Watermarked Texts From Language Models](https://mlsanity.com/paper/2511.06645/) (2025) - [DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling](https://mlsanity.com/paper/2608.03093/) (2026) - [TANGO: Watermarking Masked Diffusion Language Models in Token Pairs](https://mlsanity.com/paper/2609.35224/) (2026) - [Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key](https://mlsanity.com/paper/2610.18359/) (2026) ## Abstract (arXiv) Text watermarks for large language models (LLMs) have been commonly used to identify the origins of machine-generated content, which is promising for assessing liability when combating deepfake or harmful content. While existing watermarking techniques typically prioritize robustness against removal attacks, unfortunately, they are vulnerable to spoofing attacks: malicious actors can subtly alter the meanings of LLM-generated responses or even forge harmful content, potentially misattributing blame to the LLM developer. To overcome this, we introduce a bi-level signature scheme, Bileve, which embeds fine-grained signature bits for integrity checks (mitigating spoofing attacks) as well as a coarse-grained signal to trace text sources when the signature is invalid (enhancing detectability) via a novel rank-based sampling strategy. Compared to conventional watermark detectors that only output binary results, Bileve can differentiate 5 scenarios during detection, reliably tracing text provenance and regulating LLMs. The experiments conducted on OPT-1.3B and LLaMA-7B demonstrate the effectiveness of Bileve in defeating spoofing attacks with enhanced detectability. Code is available at https://github.com/Tongzhou0101/Bileve-official.