It’s possible to watermark LLM text output by subtly changing the next word selection based on previous output. For example, given a series of previous tokens (“The quick fox…”), a system can divide it’s vocabulary into two bins and subtly select from one bin or another. This statistical bias allows later analysis to determine if that statistical signal is present in a given block of text. Voilà, a statistical watermark.
But of course it’s possible to defeat these systems by paraphrasing the output text and eliminating the statistical signal.
In the arms race between evasion and detection, a new paper (“A Robust Semantics-based Watermarking for Large Language Models against Paraphrasing“) proposes to watermark based on the meaning of words rather than the words themselves. They group preceding tokens into bins corresponding to their meanings and bias future word selection based on those bins. The result is that simple paraphrasing of sentences won’t alter the statistical signal because retaining the meaning of a word will keep it in the same bin.