为开源大模型设计可证明鲁棒的水印技术，防篡改且仅凭输出即可检测。
Provably Robust Watermarks for Open-Source Language Models
- 修改模型参数嵌入水印，仅通过生成文本即可识别。
- 对抗模型参数篡改攻击时，需将质量降至0分才使检测率降至50%。
- 适用于需可信内容溯源的开源大模型场景。
近期高质量语言模型的爆发催生了识别生成文本的新方法。水印是主要解决方案之一，可能成为生成式AI时代的关键工具。现有方法在推理阶段嵌入水印，但依赖模型规格与参数保密，难以应用于开源场景。本文提出首个面向开源大模型的水印方案：通过修改模型参数嵌入水印，但仅凭输出即可检测。令人意外的是，我们在特定假设下证明该水印不可移除。实验基于OPT-6.7B和OPT-1.3B，验证了对词元替换和模型参数扰动的鲁棒性。其中，模型扰动攻击需将生成质量分数降至0/100，才能使检测率降至50%。
原文摘要 · Abstract (English)
The recent explosion of high-quality language models has necessitated new methods for identifying AI-generated text. Watermarking is a leading solution and could prove to be an essential tool in the age of generative AI. Existing approaches embed watermarks at inference and crucially rely on the large language model (LLM) specification and parameters being secret, which makes them inapplicable to the open-source setting. In this work, we introduce the first watermarking scheme for open-source LLMs. Our scheme works by modifying the parameters of the model, but the watermark can be detected from just the outputs of the model. Perhaps surprisingly, we prove that our watermarks are unremovable under certain assumptions about the adversary's knowledge. To demonstrate the behavior of our construction under concrete parameter instantiations, we present experimental results with OPT-6.7B and OPT-1.3B. We demonstrate robustness to both token substitution and perturbation of the model parameters. We find that the stronger of these attacks, the model-perturbation attack, requires deteriorating the quality score to 0 out of 100 in order to bring the detection rate down to 50%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。