无需模型即可检测的文本水印技术，可精准控制误报率。
ChainMark: Model-Free LLM Watermarking with Closed-Form Calibration
- 通过哈希分组和马尔可夫转移生成可验证水印。
- 在匹配预算下，误报率低于1%，抗翻译和随机替换攻击。
- 适合需要合规标记的AI生成内容监管场景。
欧盟《人工智能法案》要求对合成文本进行机器可读标记，但现有水印检测依赖生成语言模型且使用无闭式校准的启发式阈值。本文提出ChainMark，一种主动水印机制：利用密钥化SHA-256将词表划分为S个状态，并在ρ比例的位置强制执行硬马尔可夫转移；检测器仅需用相同密钥在O(n)次哈希运算内重播划分过程，无需访问生成模型。我们推导出闭式公式S*(n, ρ, α)，将目标假阳性率（FPR）、文本长度与预算映射为最小状态数（定理1），证明通用鲁棒性阈值δ* = 1 - 1/√2 ≈ 29.3%，在(S, ρ, n)上不变（定理2），并推广至任意k-正则转移拓扑（定理3）。在三种指令微调的大语言模型及四个领域中，ChainMark在匹配预算下严格优于KGW与SWEET，在翻译与随机替换攻击下表现更优；单语料库实证校准可恢复自然语言文本上1%的目标假阳性率。
原文摘要 · Abstract (English)
Regulatory regimes such as the EU AI Act mandate machine-readable marking of synthetic text, but existing watermark detectors rely on the generating LM and on heuristic thresholds with no closed-form calibration. We introduce ChainMark, an active watermark that partitions the vocabulary into S states via keyed SHA-256 and forces a hard Markov transition on a fraction rho of positions; the detector replays the partition from the same key in O(n) hash operations, with no LM access. We derive a closed-form S*(n, rho, alpha) mapping a target FPR, text length, and budget to the minimum state count (Theorem 1), prove a universal robustness threshold delta* = 1 - 1/sqrt(2) approximately 29.3% that is invariant in (S, rho, n) (Theorem 2), and generalise both to any k-regular transition topology (Theorem 3). Across three instruction-tuned LLMs and four domains, ChainMark strictly dominates KGW and SWEET under translation and random-substitution attacks at matched budget; a one-corpus empirical recalibration restores the 1% target FPR on natural-language text.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。