Publicly Detectable Watermarking for Language Models
Jaiden Fairoze Sanjam Garg Somesh Jha Saeed Mahloujifar Mohammad Mahmoody Mingyuan Wang
We construct the first provable watermarking scheme for language models with
public detectability or verifiability: we use a private key for watermarking
and a public key for watermark detection. Our protocol is the first
watermarking scheme that does not embed a statistical signal in generated text.
Rather, we directly embed a publicly-verifiable cryptographic signature using a
form of rejection sampling. We show that our construction meets strong formal
security guarantees and preserves many desirable properties found in schemes in
the private-key watermarking setting. In particular, our watermarking scheme
retains distortion-freeness and model agnosticity. We implement our scheme and
make empirical measurements over open models in the 7B parameter range. Our
experiments suggest that our watermarking scheme meets our formal claims while
preserving text quality.