CoChat
Sign Up
PreprintCited by 27Cryptography and Data SecurityAdvanced Steganography and Watermarking TechniquesAdversarial Robustness in Machine Learning

Undetectable Watermarks for Language Models

Open access
Christ, Miranda, Gunn, Sam, Zamir, Or·2023·arXiv
DOI 10.48550/arxiv.2306.09194arXiv 2306.09194
Open this paper in CoChat — free accountOpen PDF

Abstract

Recent advances in the capabilities of large language models such as GPT-4 have spurred increasing concern about our ability to detect AI-generated text. Prior works have suggested methods of embedding watermarks in model outputs, by noticeably altering the output distribution. We ask: Is it possible to introduce a watermark without incurring any detectable change to the output distribution? To this end we introduce a cryptographically-inspired notion of undetectable watermarks for language models. That is, watermarks can be detected only with the knowledge of a secret key; without the secret key, it is computationally intractable to distinguish watermarked outputs from those of the original model. In particular, it is impossible for a user to observe any degradation in the quality of the text. Crucially, watermarks should remain undetectable even when the user is allowed to adaptively query the model with arbitrarily chosen prompts. We construct undetectable watermarks based on the existence of one-way functions, a standard assumption in cryptography.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2306.09194

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Later steganographic schemes with non-trivial security properties achieved high undetectability under improved robustness and efficiency.

    “Later steganographic schemes with non-trivial security properties (Christ et al., 2023;Zamir, 2024) achieved high undetectability under improved robustness and efficiency.”

    From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Christ et al., 2023

    Section 3 describes the paper’s main construction as undetectable, sound and efficient, and Section 4.4 says its substring-complete version detects sufficiently high-entropy contiguous text. But the source presents this as a watermarking scheme, not a steganographic scheme; Section 7 limits its robustness guarantee to an intact substring and leaves broader resistance to removal attacks open. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 22

  1. Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 2021 IEEE Symposium on Security and Privacy (SP), pages 121-140. IEEE, 2021. 4
  2. Mikhail J Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann, Florian Ker- schbaum, Dina Mohamed, and Sanket Naik. Natural language watermarking: Design, analysis, and a proof-of-concept implementation. In Information Hiding: 4th Interna- tional Workshop, IH 2001 Pittsburgh, PA, USA, April 25-27, 2001 Proceedings 4, pages 185-200. Springer, 2001. 6
  3. Mikhail J Atallah, Victor Raskin, Christian F Hempelmann, Mercan Karahan, Radu Sion, Umut Topkara, and Katrina E Triezenberg. Natural language watermarking and tamperproofing. In Information Hiding: 5th International Workshop, IH 2002 No- ordwijkerhout, The Netherlands, October 7-9, 2002 Revised Papers 5, pages 196-212. Springer, 2003.
  4. Daria Beresneva. Computer-generated text detection using machine learning: A sys- tematic review. In Natural Language Processing and Information Systems: 21st In- ternational Conference on Applications of Natural Language to Information Systems, NLDB 2016, Salford, UK, June 22-24, 2016, Proceedings 21, pages 421-426. Springer, 2016. 4
  5. Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. On the possibilities of ai-generated text detection. arXiv preprint arXiv:2304.04736, 2023. · arXiv
  6. Nenad Dedić, Gene Itkis, Leonid Reyzin, and Scott Russell. Upper and lower bounds on black-box steganography. Journal of Cryptology, 22:365-394, 2009.
  7. Oded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random func- tions. Journal of the ACM (JACM), 33(4):792-807, 1986.
  8. Shafi Goldwasser, Michael P Kim, Vinod Vaikuntanathan, and Or Zamir. Planting undetectable backdoors in machine learning models. In 2022 IEEE 63rd Annual Sym- posium on Foundations of Computer Science (FOCS), pages 931-942. IEEE, 2022.
  9. Sebastian Gehrmann, Hendrik Strobelt, and Alexander M Rush. Gltr: Statistical de- tection and visualization of generated text. arXiv preprint arXiv:1906.04043, 2019. · arXiv
  10. Johan Håstad, Russell Impagliazzo, Leonid A Levin, and Michael Luby. A pseudoran- dom generator from any one-way function. SIAM Journal on Computing, 28(4):1364- 1396, 1999.
  11. Nicholas Hopper, David Molnar, and David Wagner. From weak to strong watermark- ing. In Theory of Cryptography: 4th Theory of Cryptography Conference, TCC 2007, Amsterdam, The Netherlands, February 21-24, 2007. Proceedings 4, pages 362-382. Springer, 2007.
  12. Nicholas J. Hopper, Luis von Ahn, and John Langford. Provably secure steganography. IEEE Trans. Computers, 58(5):662-676, 2009. 5, 13
  13. Ganesh Jawahar, Muhammad Abdul-Mageed, and Laks VS Lakshmanan. Automatic detection of machine generated text: A critical survey. arXiv preprint arXiv:2011.01314, 2020. · arXiv
  14. Svante Janson. Tail bounds for sums of geometric and exponential variables. Statistics & Probability Letters, 135:1-6, 2018. 17, 18
  15. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. CoRR, abs/2301.10226, 2023. 3, 4, 5, 7, 13, 27, 28 · arXiv
  16. Gabriel Kaptchuk, Tushar M. Jois, Matthew Green, and Aviel D. Rubin. Meteor: Cryptographically secure steganography for realistic distributions. In Yongdae Kim, Jong Kim, Giovanni Vigna, and Elaine Shi, editors, CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, Republic of Korea, November 15 -19, 2021, pages 1529-1548. ACM, 2021. 5
  17. Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu, and James Zou. Gpt detectors are biased against non-native english writers. arXiv preprint arXiv:2304.02819, 2023. 4 · arXiv
  18. Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. Detectgpt: Zero-shot machine-generated text detection using probability curva- ture. CoRR, abs/2301.11305, 2023. · arXiv
  19. Travis Munyer and Xin Zhong. Deeptextmark: Deep learning based text watermarking for detection of large language model generated text. arXiv preprint arXiv:2305.05773, 2023. · arXiv
  20. Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? CoRR, abs/2303.11156, 2023. · arXiv
  21. KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust natural language watermarking through invariant features. arXiv preprint arXiv:2305.01904, 2023. 4 · arXiv
  22. Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. Defending against neural fake news. Advances in neural information processing systems, 32, 2019.

Cited by

Sorted by citations

Authors
Christ, M., Gunn, S., & Zamir, O.
Affiliations
  • Columbia University (US)
  • University of California, Berkeley (US)
  • Princeton University (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2023
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2306.09194
arXiv
2306.09194
OpenAlex
W4380994421
Cited by
27
References
1
Citations by year
2025: 21 · 2024: 4 · 2023: 2
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
  • arXiv (Cornell University)
Funders
National Science Foundation (1763970, 2107187, 2212233)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
large language models, AI-generated text detection, output distribution, one-way functions, cryptographic assumptions, secret key, adaptive queries, watermarking

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review