Distortion-free Watermarks are not Truly Distortion-free under Watermark Key Collisions
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
Language model (LM) watermarking techniques inject a statistical signal into LM-generated content by substituting the random sampling process with pseudo-random sampling, using watermark keys as the random seed. Among these statistical watermarking approaches, distortion-free watermarks are particularly crucial because they embed watermarks into LM-generated content without compromising generation quality. However, one notable limitation of pseudo-random sampling compared to true-random sampling is that, under the same watermark keys (i.e., key collision), the results of pseudo-random sampling exhibit correlations. This limitation could potentially undermine the distortion-free property. Our studies reveal that key collisions are inevitable due to the limited availability of watermark keys, and existing distortion-free watermarks exhibit a significant distribution bias toward the original LM distribution in the presence of key collisions. Moreover, achieving a perfect distortion-free watermark is impossible as no statistical signal can be embedded under key collisions. To reduce the distribution bias caused by key collisions, we introduce a new family of distortion-free watermarks--beta-watermark. Experimental results support that the beta-watermark can effectively reduce the distribution bias under key collisions.
Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 24 of its 43 references that are in the map. First posted on arXiv 2 Jun 2024.
Builds on
24 of 43 references.
Closest ancestors · 9
Same direction, newest first
- 2023A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models11 Oct
- 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
- 2023Unbiased Watermark for Large Language Models22 Sep
- 2023An Unforgeable Publicly Verifiable Watermark for Large Language Models30 Jul
- 2023Robust Distortion-free Watermarks for Language Models28 Jul
- 2023Provable Robust Watermarking for AI-Generated Text30 Jun
- 2023Undetectable Watermarks for Language Models25 May
- 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
- 2023A Watermark for Large Language Models24 Jan
Other references · 15
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
- 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,201
- 2015Teaching Machines to Read and Comprehendcited by 1,039
- 2020Multilingual Denoising Pre-training for Neural Machine Translationcited by 1,028
- 2023DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvaturecited by 705
- 2019Defending Against Neural Fake Newscited by 553
- 2023On the Possibilities of AI-Generated Text Detectioncited by 88
- 2024Your Vision-Language Model Itself Is a Strong Filter: Towards High-Quality Instruction Tuning with Data Selectioncited by 48
- 2022Adversarial Weight Perturbation Improves Generalization in Graph Neural Networkscited by 21
- 2023Learning to Learn from APIs: Black-Box Data-Free Meta-Learningcited by 18
3 more
- 2022RetrievalGuard: Provably Robust 1-Nearest Neighbor Image Retrievalcited by 15
- 2020Reverse Engineering Configurations of Neural Text Generation Modelscited by 14
- 2022A Law of Robustness beyond Isoperimetrycited by 9
Built on by
Citing papers per year: 2024: 4; 2025: 3; 2026: 3.
10 papers.
- 2024Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approachcited by 17
- 2024A Watermark for Order-Agnostic Language Modelscited by 14
- 2025Improved Unbiased Watermark for Large Language Modelscited by 13
- 2024De-mark: Watermark Removal in Large Language Modelscited by 11
- 2025Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMscited by 11
- 2024Can Watermarked LLMs be Identified by Users via Crafted Prompts?cited by 10
- 2026More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensemblescited by 2
- 2026Hidden in Plain Tokens: Simply Robust, Gradient-Free Watermark for Synthetic Audiocited by 2
- 2025MarkTune: Improving the Quality-Detectability Trade-off in Open-Weight LLM Watermarkingcited by 0
- 2026Robust Text Watermarking for Large Language Models via Dual Semantic Embeddingscited by 0
- 2026Robust Text Watermarking for Large Language Models via Dual Semantic Embeddings30 Jun 2026
- 2026Hidden in Plain Tokens: Simply Robust, Gradient-Free Watermark for Synthetic Audio25 May 2026
- 2026More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles12 Feb 2026
- 2025MarkTune: Improving the Quality-Detectability Trade-off in Open-Weight LLM Watermarking3 Dec 2025
- 2025Improved Unbiased Watermark for Large Language Models16 Feb 2025
- 2025Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs15 Feb 2025
- 2024De-mark: Watermark Removal in Large Language Models17 Oct 2024
- 2024A Watermark for Order-Agnostic Language Models17 Oct 2024
- 2024Can Watermarked LLMs be Identified by Users via Crafted Prompts?4 Oct 2024
- 2024Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach3 Oct 2024