Title: Topic-based Watermarks for LLM-Generated Text Show Chinese title

Title: 基于主题的LLM生成文本水印

Abstract: Recent advancements of large language models (LLMs) have resulted in indistinguishable text outputs comparable to human-generated text. Watermarking algorithms are potential tools that offer a way to differentiate between LLM- and human-generated text by embedding detectable signatures within LLM-generated output. However, current watermarking schemes lack robustness against known attacks against watermarking algorithms. In addition, they are impractical considering an LLM generates tens of thousands of text outputs per day and the watermarking algorithm needs to memorize each output it generates for the detection to work. In this work, focusing on the limitations of current watermarking schemes, we propose the concept of a "topic-based watermarking algorithm" for LLMs. The proposed algorithm determines how to generate tokens for the watermarked LLM output based on extracted topics of an input prompt or the output of a non-watermarked LLM. Inspired from previous work, we propose using a pair of lists (that are generated based on the specified extracted topic(s)) that specify certain tokens to be included or excluded while generating the watermarked output of the LLM. Using the proposed watermarking algorithm, we show the practicality of a watermark detection algorithm. Furthermore, we discuss a wide range of attacks that can emerge against watermarking algorithms for LLMs and the benefit of the proposed watermarking scheme for the feasibility of modeling a potential attacker considering its benefit vs. loss. Show Chinese abstract

Abstract: 最近大型语言模型（LLMs）的进展已导致生成的文本输出与人类生成的文本难以区分。 水印算法是潜在的工具，可以通过在LLM生成的输出中嵌入可检测的标识符，来区分LLM生成和人类生成的文本。 然而，当前的水印方案在面对已知的水印算法攻击时缺乏鲁棒性。 此外，考虑到LLM每天生成数以万计的文本输出，水印算法需要记住每个生成的输出以进行检测，这使得它们不切实际。 在这项工作中，针对当前水印方案的局限性，我们提出了“基于主题的水印算法”的概念。 该算法根据输入提示的提取主题或非水印LLM的输出来确定如何为水印LLM输出生成标记。 受之前工作的启发，我们提出使用一对列表（这些列表基于指定的提取主题生成），这些列表在生成水印LLM输出时指定了某些标记应包含或排除。 使用所提出的水印算法，我们展示了水印检测算法的实用性。 此外，我们讨论了可能针对LLM水印算法出现的各种攻击，以及所提出的水印方案在建模潜在攻击者时的可行性优势与其收益与损失之间的权衡。