通过优化种子池提升大模型水印质量与可检测性平衡
WaterSearch: Exploring Seed Pooling for Improving the Quality-Detectability Trade-off in LLM Watermarking
- 用种子池并行生成实现水印信号多样性
- 在95%检测强度下平均性能提升51.01%
- 适合需要强鲁棒水印的生成场景
水印是保障大语言模型生成文本安全的关键技术。现有方法通过调整词元生成概率嵌入信号,但往往在可检测性与文本质量间存在权衡:信号强度和随机性会降低下游任务性能。本文提出WaterSearch,一种基于句子级搜索的水印框架,通过控制种子池实现水印文本的多样化并行生成。该方法联合优化分布保真度与水印信号特性,显著提升文本质量。同时配备具有强抗攻击能力的句子级检测方法。在三个主流LLM上对十种任务进行评估,结果表明,在95%检测强度下,相比最先进基线平均提升51.01%;在短文本和低熵输出等挑战场景中,性能分别提升47.78%和36.47%。在插入、同义替换、改写等攻击下仍保持高可检测性,验证了其鲁棒性。代码已开源。
原文摘要 · Abstract (English)
Watermarking acts as a critical safeguard in text generated by Large Language Models (LLMs). By embedding identifiable signals into model outputs, watermarking enables reliable attribution and enhances the security of machine-generated content. Existing approaches typically embed signals by manipulating token generation probabilities. Despite their effectiveness, these methods inherently face a trade-off between detectability and text quality: the signal strength and randomness required for robust watermarking tend to degrade the performance of downstream tasks. In this paper, we design a novel embedding scheme that controls seed pools to facilitate diverse parallel generation of watermarked text. Based on that scheme, we propose WaterSearch, a sentence-level, search-based watermarking framework adaptable to a wide range of existing methods. WaterSearch enhances text quality by jointly optimizing two key aspects: 1) distribution fidelity and 2) watermark signal characteristics. Furthermore, WaterSearch is complemented by a sentence-level detection method with strong attack robustness. We evaluate our method on three popular LLMs across ten diverse tasks. Extensive experiments demonstrate that our method achieves an average performance improvement of 51.01\% over state-of-the-art baselines at a watermark detectability strength of 95\%. In challenging scenarios such as short text generation and low-entropy output generation, our method yields performance gains of 47.78\% and 36.47\%, respectively. Moreover, under different attack senarios including insertion, synonym substitution and paraphrase attasks, WaterSearch maintains high detectability, further validating its robust anti-attack capabilities. Our code is available at \href{https://github.com/Yukang-Lin/WaterSearch}{https://github.com/Yukang-Lin/WaterSearch}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。