Abstract:Recent advancements in large language models (LLMs) have highlighted the risk of misusing them, raising the need for accurate detection of LLM-generated content. In response, a viable solution is to inject imperceptible identifiers into LLMs, known as watermarks. Our research extends the existing watermarking methods by proposing the novel Sampling One Then Accepting (STA-1) method. STA-1 is an unbiased watermark that preserves the original token distribution in expectation and has a lower risk of producing unsatisfactory outputs in low-entropy scenarios compared to existing unbiased watermarks. In watermark detection, STA-1 does not require prompts or a white-box LLM, provides statistical guarantees, demonstrates high efficiency in detection time, and remains robust against various watermarking attacks. Experimental results on low-entropy and high-entropy datasets demonstrate that STA-1 achieves the above properties simultaneously, making it a desirable solution for watermarking LLMs. Implementation codes for this study are available online.
What problem does this paper attempt to address?
The problem that this paper attempts to solve is: how to inject an unbiased and low - risk watermarking method into the content generated by large language models (LLMs) to ensure that it can be accurately detected whether this content is generated by LLMs. Specifically, the researchers proposed a new method named Sampling One Then Accepting (STA - 1), aiming to solve the following problems:
1. **Unbiasedness**: The watermarking method should adjust the probability distribution while maintaining the same expected value as the unwatermarked distribution, so that the watermarked and unwatermarked texts cannot be distinguished.
2. **Low - risk**: In low - entropy scenarios (such as code generation), the watermarking method should have a lower risk and avoid generating unsatisfactory outputs, that is, high - probability tokens can still be sampled.
3. **Black - box Detection**: No prompts or white - box LLMs are required during the detection phase, providing statistical guarantees, and being efficient and robust.
### Research Background and Motivation
With the development of large language models, the risk of their abuse is also increasing, such as generating prejudiced, false or malicious content. In order to reduce this harm, it is crucial to accurately and efficiently identify the content generated by LLMs. Although the existing watermarking methods have certain effects, they cannot satisfy all of the above characteristics simultaneously. Therefore, the researchers proposed the STA - 1 method to make up for this deficiency.
### Characteristics of the STA - 1 Method
- **Unbiasedness**: STA - 1 ensures unbiasedness by sampling tokens from the original probability distribution and stopping sampling only when accepting tokens in the green list.
- **Low - risk**: STA - 1 performs better in low - entropy scenarios and reduces the risk of generating unsatisfactory outputs.
- **Black - box Detection**: STA - 1 uses the z - test for detection, without the need for prompts or white - box LLMs, and has a time complexity of O(m), where m is the number of tokens.
- **Statistical Guarantee**: Based on the Gini index, it provides a statistical guarantee for type II errors.
- **Robustness**: It has strong resistance to various watermarking attacks.
### Experimental Results
The experimental results show that STA - 1 performs well on both low - entropy and high - entropy datasets, verifying its unbiasedness and low - risk characteristics. In addition, STA - M, as an extension of STA - 1, repeats sampling in the high - entropy step, further enhancing the watermark strength while maintaining the text quality.
In conclusion, this paper proposes a new watermarking method STA - 1, which solves the deficiencies of existing methods in terms of unbiasedness, low - risk, black - box detection, etc., and provides a more effective solution for the detection of content generated by LLMs.