通过过滤干扰词提升弱信号水印检测准确率，无需修改模型。
Signature filtering: a lightweight enhancement for statistical watermark detection in large language models
- 识别并移除干扰水印检测的特征标记，提升判别可靠性。
- 在弱信号场景下检测率从8%~31%提升至78%~99%。
- 适用于多种水印类型和模型，部署简单且不增加计算负担。
统计水印有助于组织追踪大语言模型（LLM）生成内容的来源，但现有检测器在水印信号弱、文本重复或被编辑时表现不佳。本文提出签名过滤（signature filtering），一种检测时模块，可在不修改水印嵌入和文本生成的前提下增强检测能力。该方法通过在小规模训练集上求解混合整数线性规划，学习一组使检测不可靠的“签名”标记，并在检测前将其移除。同时，针对多种攻击模型（无色盲、自适应色彩、分布相关）推导了有限样本与渐近边界。在四个知名水印家族（Kgw、Sweet、Unigram、Exp）、四个基准语料库（C4、MBPP、HumanEval、Code-Search-Net）及六种LLM（Opt-1.3b、Opt-6.7b、Llama2-13b、Llama3.1-8b、Qwen2.5-14b、Phi-3-medium-14b）上，2-和3-元组签名将弱信号与低熵场景下的检测率从8%~31%提升至78%~99%，同时保持误报率可控甚至可忽略。在扰动25%~50%标记的强压力测试中，2-元组过滤对Kgw型水印仍能保留大部分原始检测优势，常优于先进检测器WinMax。签名过滤为信息处理流程中的水印溯源提供了一种轻量、可扩展、模型无关的增强方案。
原文摘要 · Abstract (English)
Statistical watermarks help organizations attribute large language model (LLM) outputs, yet existing detectors often struggle when watermark signals are weak, texts are repetitive, or watermarks are edited. We propose signature filtering, a detection-time module that enhances watermark detection without modifying watermark embedding and text generation. It learns a small set of ``signature'' tokens whose presence makes watermark tests unreliable, and removes these tokens before detection. The signatures are obtained by solving a mixed-integer linear program on a small training set, with constraints that maximize the true positive rate. We additionally derive finite-sample and asymptotic bounds under several attacker models (color-blind, color-adaptive, and distributionally correlated). On four well-known watermark families (Kgw, Sweet, Unigram, Exp), four benchmark corpora (C4, MBPP, HumanEval, Code-Search-Net), and six LLMs (Opt-1.3b, Opt-6.7b, Llama2-13b, Llama3.1-8b, Qwen2.5-14b, Phi-3-medium-14b), 2- and 3-gram signatures raise detection rates in weak-signal and low-entropy settings from 8~31% without filtering to 78~99% with filtering, while keeping false positives controllable and often negligible. In stress tests where we scramble sentences and perturb 25~50% of tokens by dilution, deletions, and substitutions, 2-gram filters for Kgw-style watermarks preserve most of the clean-text detection gains, often matching or outperforming the advanced WinMax watermark detector. Signature filtering thus provides a simple, scalable, and model-agnostic add-on to strengthen watermark-based provenance checks for LLM text in information processing workflows.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。