mlsanityData to 7 Oct 2026

Distortion-free Watermarks are not Truly Distortion-free under Watermark Key Collisions

arXiv 2406.02603 ↗First posted 2 Jun 2024cs.CR cs.LGcited by 10

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Language model (LM) watermarking techniques inject a statistical signal into LM-generated content by substituting the random sampling process with pseudo-random sampling, using watermark keys as the random seed. Among these statistical watermarking approaches, distortion-free watermarks are particularly crucial because they embed watermarks into LM-generated content without compromising generation quality. However, one notable limitation of pseudo-random sampling compared to true-random sampling is that, under the same watermark keys (i.e., key collision), the results of pseudo-random sampling exhibit correlations. This limitation could potentially undermine the distortion-free property. Our studies reveal that key collisions are inevitable due to the limited availability of watermark keys, and existing distortion-free watermarks exhibit a significant distribution bias toward the original LM distribution in the presence of key collisions. Moreover, achieving a perfect distortion-free watermark is impossible as no statistical signal can be embedded under key collisions. To reduce the distribution bias caused by key collisions, we introduce a new family of distortion-free watermarks--beta-watermark. Experimental results support that the beta-watermark can effectively reduce the distribution bias under key collisions.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 24 of its 43 references that are in the map. First posted on arXiv 2 Jun 2024.

Builds on

24 of 43 references.

Closest ancestors · 9

Same direction, newest first

  1. 2023A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models11 Oct
  2. 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
  3. 2023Unbiased Watermark for Large Language Models22 Sep
  4. 2023An Unforgeable Publicly Verifiable Watermark for Large Language Models30 Jul
  5. 2023Robust Distortion-free Watermarks for Language Models28 Jul
  6. 2023Provable Robust Watermarking for AI-Generated Text30 Jun
  7. 2023Undetectable Watermarks for Language Models25 May
  8. 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
  9. 2023A Watermark for Large Language Models24 Jan

Other references · 15

  1. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  4. 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,201
  5. 2015Teaching Machines to Read and Comprehendcited by 1,039
  6. 2020Multilingual Denoising Pre-training for Neural Machine Translationcited by 1,028
  7. 2023DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvaturecited by 705
  8. 2019Defending Against Neural Fake Newscited by 553
  9. 2023On the Possibilities of AI-Generated Text Detectioncited by 88
  10. 2024Your Vision-Language Model Itself Is a Strong Filter: Towards High-Quality Instruction Tuning with Data Selectioncited by 48
  11. 2022Adversarial Weight Perturbation Improves Generalization in Graph Neural Networkscited by 21
  12. 2023Learning to Learn from APIs: Black-Box Data-Free Meta-Learningcited by 18
3 more
  1. 2022RetrievalGuard: Provably Robust 1-Nearest Neighbor Image Retrievalcited by 15
  2. 2020Reverse Engineering Configurations of Neural Text Generation Modelscited by 14
  3. 2022A Law of Robustness beyond Isoperimetrycited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 3; 2026: 3.

10 papers.