CoChat
Sign Up
PreprintCited by 4Advanced Steganography and Watermarking TechniquesAdversarial Robustness in Machine LearningPhysical Unclonable Functions (PUFs) and Hardware Security

The DOI matches its DataCite record.

SemStamp: A Semantic Watermark with Paraphrastic Robustness for Text Generation

Open access
Hou, Abe Bohan, Zhang, Jingyu, He, Tianxing, Wang, Yichen, Chuang, Yung-Sung, Wang, Hongwei, Shen, Lingfeng, Van Durme, Benjamin, Khashabi, Daniel, Tsvetkov, Yulia·2023·arXiv
DOI 10.48550/arxiv.2310.03991arXiv 2310.03991
Open this paper in CoChat — free accountOpen PDF

Abstract

Existing watermarking algorithms are vulnerable to paraphrase attacks because of their token-level design. To address this issue, we propose SemStamp, a robust sentence-level semantic watermarking algorithm based on locality-sensitive hashing (LSH), which partitions the semantic space of sentences. The algorithm encodes and LSH-hashes a candidate sentence generated by an LLM, and conducts sentence-level rejection sampling until the sampled sentence falls in watermarked partitions in the semantic embedding space. A margin-based constraint is used to enhance its robustness. To show the advantages of our algorithm, we propose a "bigram" paraphrase attack using the paraphrase that has the fewest bigram overlaps with the original sentence. This attack is shown to be effective against the existing token-level watermarking method. Experimental results show that our novel semantic watermark algorithm is not only more robust than the previous state-of-the-art method on both common and bigram paraphrase attacks, but also is better at preserving the quality of generation.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2310.03991

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Experimental results indicate that SemStamp is more robust than previous SOTA methods in defending against common and more effective bigram paraphrase attacks and is superior in maintaining the quality of text generation.

    “Experimental results indicate that this method is not only more robust than previous SOTA methods in defending against common and more effective bigram paraphrase attacks but also superior in maintaining the quality of text generation.”

    From A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directions (2025) · cites this paper as Hou et al. 2023

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

No references could be resolved yet.

Research works printed but not linked: 55

  1. Mikhail J. Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann, Florian Kerschbaum, Dina Mohamed, and Sanket Naik. 2001. Natural lan- guage watermarking: Design, analysis, and a proof- of-concept implementation. In Information Hiding, pages 185-200, Berlin, Heidelberg. Springer Berlin Heidelberg.
  2. Mikhail J. Atallah, Victor Raskin, Christian F. Hempel- mann, Mercan Karahan, Radu Sion, Umut Topkara, and Katrina E. Triezenberg. 2002. Natural language watermarking and tamperproofing. In International Workshop on Information Hiding, pages 196-212.
  3. Daniel Cer, Mona Diab, Eneko Agirre, Iñigo Lopez- Gazpio, and Lucia Specia. 2017. SemEval-2017 task 1: Semantic textual similarity multilingual and crosslingual focused evaluation. In Proceedings of the 11th International Workshop on Semantic Evaluation (SemEval-2017), pages 1-14, Vancouver, Canada. Association for Computational Linguistics. · DOI · Paper page
  4. Souradip Chakraborty, Amrit Singh Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. 2023. On the possibilities of ai-generated text detection. arXiv preprint arXiv:2304.04736. · arXiv
  5. Moses S Charikar. 2002. Similarity estimation tech- niques from rounding algorithms. In Proceedings of the thiry-fourth annual ACM symposium on Theory of computing, pages 380-388.
  6. Seungtaek Choi, Myeongho Jeong, Hojae Han, and Se- ung won Hwang. 2022. C2l: Causally contrastive learning for robust text classification. In AAAI Con- ference on Artificial Intelligence.
  7. Miranda Christ, Sam Gunn, and Or Zamir. 2023. Un- detectable watermarks for language models. ArXiv, abs/2306.09194. · arXiv
  8. Hongchao Fang, Sicheng Wang, Meng Zhou, Jiayuan Ding, and Pengtao Xie. 2020. Cert: Contrastive self-supervised learning for language understanding. ArXiv, abs/2005.12766. · arXiv
  9. Yu Fu, Deyi Xiong, and Yue Dong. 2023. Watermarking conditional text generation for ai detection: Unveiling challenges and a semantic-aware watermark remedy. ArXiv, abs/2307.13808. · arXiv
  10. Tianyu Gao, Xingcheng Yao, and Danqi Chen. 2021. Simcse: Simple contrastive learning of sentence em- beddings. arXiv preprint arXiv:2104.08821. · arXiv
  11. Sebastian Gehrmann, Hendrik Strobelt, and Alexan- der M Rush. 2019. Gltr: Statistical detection and visualization of generated text. arXiv preprint arXiv:1906.04043. · arXiv
  12. Chenxi Gu, Chengsong Huang, Xiaoqing Zheng, Kai- Wei Chang, and Cho-Jui Hsieh. 2022. Watermark- ing pre-trained language models with backdooring. arXiv preprint arXiv:2210.07543. · arXiv
  13. Kelvin Guu, Tatsunori B. Hashimoto, Yonatan Oren, and Percy Liang. 2018. Generating sentences by editing prototypes. Transactions of the Association for Computational Linguistics, 6:437-450. · DOI · Paper page
  14. R. Hadsell, S. Chopra, and Y. LeCun. 2006. Dimension- ality reduction by learning an invariant mapping. In 2006 IEEE Computer Society Conference on Com- puter Vision and Pattern Recognition (CVPR'06), volume 2, pages 1735-1742. · DOI · Paper page
  15. Seungju Han, Beomsu Kim, and Buru Chang. 2022. Measuring and improving semantic diversity of dia- logue generation. In Findings of the Association for Computational Linguistics: EMNLP 2022.
  16. Piotr Indyk and Rajeev Motwani. 1998. Approximate nearest neighbors: Towards removing the curse of di- mensionality. In Proceedings of the Thirtieth Annual ACM Symposium on Theory of Computing, STOC '98, page 604-613, New York, NY, USA. Associa- tion for Computing Machinery. · DOI · Paper page
  17. Daphne Ippolito, Daniel Duckworth, Chris Callison- Burch, and Douglas Eck. 2020. Automatic detec- tion of generated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 1808-1822, Online. Association for Computational Linguistics. · DOI · Paper page
  18. Daphne Ippolito, Florian Tramèr, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christo- pher A Choquette-Choo, and Nicholas Carlini. 2022. Preventing verbatim memorization in language mod- els gives a false sense of privacy. arXiv preprint arXiv:2210.17546. · arXiv
  19. Ganesh Jawahar, Muhammad Abdul-Mageed, and Laks Lakshmanan, V.S. 2020. Automatic detection of ma- chine generated text: A critical survey. In Proceed- ings of the 28th International Conference on Com- putational Linguistics, pages 2296-2309, Barcelona, Spain (Online). International Committee on Compu- tational Linguistics. · DOI · Paper page
  20. Nitish Shirish Keskar, Bryan McCann, Lav Varsh- ney, Caiming Xiong, and Richard Socher. 2019. CTRL -A Conditional Transformer Language Model for Controllable Generation. arXiv preprint arXiv:1909.05858. · arXiv
  21. Byeongchang Kim, Hyunwoo Kim, and Gunhee Kim. 2019. Abstractive Summarization of Reddit Posts with Multi-level Memory Networks. In NAACL-HLT.
  22. Taeuk Kim, Kang Min Yoo, and Sang goo Lee. 2021. Self-guided contrastive learning for bert sentence representations. ArXiv, abs/2106.07345. · arXiv
  23. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023a. A watermark for large language models. arXiv preprint arXiv:2301.10226. · arXiv
  24. Tassilo Klein and Moin Nabi. 2020. Contrastive self- supervised learning for commonsense reasoning. ArXiv, abs/2005.00669. · arXiv
  25. Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Paraphras- ing evades detectors of ai-generated text, but re- trieval is an effective defense. arXiv preprint arXiv:2303.13408. · arXiv
  26. Wojciech Kryściński, Nazneen Rajani, Divyansh Agar- wal, Caiming Xiong, and Dragomir Radev. 2021. Booksum: A collection of datasets for long- form narrative summarization. arXiv preprint arXiv:2105.08209. · arXiv
  27. Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023. Robust distortion-free watermarks for language models. ArXiv, abs/2307.15593. · arXiv
  28. Shuang Li, Xuming Hu, Li Lin, and Lijie Wen. 2022. Pair-level supervised contrastive learning for natural language inference. ICASSP 2022 -2022 IEEE Inter- national Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 8237-8241.
  29. Xiaoming Liu, Zhaohan Zhang, Yichen Wang, Yu Lan, and Chao Shen. 2022. Coco: Coherence- enhanced machine-generated text detection under data limitation with contrastive learning. ArXiv, abs/2212.10341. · arXiv
  30. Yixin Liu, Hongsheng Hu, Xuyun Zhang, and Lichao Sun. 2023. Watermarking text data on large lan- guage models for dataset copyright protection. ArXiv, abs/2305.13257. · arXiv
  31. Lajanugen Logeswaran and Honglak Lee. 2018. An efficient framework for learning sentence representa- tions. arXiv preprint arXiv:1803.02893. · arXiv
  32. Fatemehsadat Mireshghallah, Justus Mattern, Sicun Gao, R. Shokri, and Taylor Berg-Kirkpatrick. 2023. Smaller language models are better black- box machine-generated text detectors. ArXiv, abs/2305.09859. · arXiv
  33. Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. 2023. Detectgpt: Zero-shot machine-generated text detec- tion using probability curvature. In International Conference on Machine Learning.
  34. Artidoro Pagnoni, Martin Graciarena, and Yulia Tsvetkov. 2022. Threat scenarios and best practices to detect neural fake news. In Proceedings of the 29th International Conference on Computational Lin- guistics, pages 1233-1249, Gyeongju, Republic of Korea. International Committee on Computational Linguistics.
  35. Xiao Pu, Jingyu Zhang, Xiaochuang Han, Yulia Tsvetkov, and Tianxing He. 2023. On the zero-shot generalization of machine-generated text detectors. In Findings of the Association for Computational Lin- guistics: EMNLP 2023, pages 4799-4808, Singapore. Association for Computational Linguistics.
  36. Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the lim- its of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research (JMLR).
  37. Deepak Ravichandran, Patrick Pantel, and Eduard Hovy. 2005. Randomized algorithms and NLP: Using lo- cality sensitive hash functions for high speed noun clustering. In Proceedings of the 43rd Annual Meet- ing of the Association for Computational Linguistics (ACL'05), pages 622-629, Ann Arbor, Michigan. As- sociation for Computational Linguistics. · DOI
  38. Nils Reimers and Iryna Gurevych. 2019. Sentence- BERT: Sentence embeddings using Siamese BERT- networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natu- ral Language Processing (EMNLP-IJCNLP), pages 3982-3992, Hong Kong, China. Association for Com- putational Linguistics. · DOI · Paper page
  39. Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voss, Jeff Wu, Alec Radford, and Jasmine Wang. 2019. Release strategies and the social impacts of language models. ArXiv, abs/1908.09203. · arXiv
  40. Jinyan Su, Terry Yue Zhuo, Di Wang, and Preslav Nakov. 2023. Detectllm: Leveraging log rank information for zero-shot detection of machine-generated text. arXiv preprint arXiv:2306.05540. · arXiv
  41. Benjamin Van Durme and Ashwin Lall. 2010. Online generation of locality sensitive hash signatures. In Proceedings of the ACL 2010 Conference Short Pa- pers, pages 231-235, Uppsala, Sweden. Association for Computational Linguistics.
  42. Ashish Venugopal, Jakob Uszkoreit, David Talbot, Franz Och, and Juri Ganitkevitch. 2011. Watermark- ing the outputs of structured prediction with an appli- cation in statistical machine translation. In Proceed- ings of the 2011 Conference on Empirical Methods in Natural Language Processing.
  43. Lean Wang, Wenkai Yang, Deli Chen, Haozhe Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. 2023. Towards codable text watermarking for large language models. ArXiv, abs/2307.15992. · arXiv
  44. Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, et al. 2021. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359. · arXiv
  45. Nathaniel Weir, João Sedoc, and Benjamin Van Durme. 2020a. COD3S: diverse generation with discrete semantic signatures. In Proceedings of the 2020 Con- ference on Empirical Methods in Natural Language Processing (EMNLP).
  46. Nathaniel Weir, João Sedoc, and Benjamin Van Durme. 2020b. COD3S: Diverse generation with discrete semantic signatures. In Proceedings of the 2020 Con- ference on Empirical Methods in Natural Language Processing (EMNLP), pages 5199-5211, Online. As- sociation for Computational Linguistics. · DOI
  47. John Wieting, Kevin Gimpel, Graham Neubig, and Tay- lor Berg-kirkpatrick. 2022. Paraphrastic representa- tions at scale. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Process- ing: System Demonstrations, pages 379-388, Abu Dhabi, UAE. Association for Computational Linguis- tics.
  48. Kevin Yang and Dan Klein. 2021. FUDGE: Controlled text generation with future discriminators. In Pro- ceedings of the 2021 Conference of the North Amer- ican Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 3511-3535, Online. Association for Computational Linguistics. · DOI
  49. Hongwei Yao, Jian Lou, Kui Ren, and Zhan Qin. 2023. Promptcare: Prompt copyright protection by watermark injection and verification. ArXiv, abs/2308.02816. · arXiv
  50. Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi. 2019. Defending against neural fake news. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett, editors, Ad- vances in Neural Information Processing Systems 32, pages 9054-9065.
  51. Jingqing Zhang, Yao Zhao, Mohammad Saleh, and Peter Liu. 2020. Pegasus: Pre-training with extracted gap- sentences for abstractive summarization. In Interna- tional Conference on Machine Learning (ICML).
  52. Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher De- wan, Mona Diab, Xian Li, Xi Victoria Lin, et al. 2022. OPT: Open Pre-trained Transformer Language Models. arXiv preprint arXiv:2205.01068. · arXiv
  53. Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Wein- berger, and Yoav Artzi. 2019. Bertscore: Evaluating text generation with bert. In International Confer- ence on Learning Representations (ICLR).
  54. Yizhe Zhang, Michel Galley, Jianfeng Gao, Zhe Gan, Xi- ujun Li, Chris Brockett, and William B. Dolan. 2018. Generating informative and diverse conversational responses via adversarial information maximization. In NeurIPS.
  55. Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023. Provable robust water- marking for ai-generated text. arXiv preprint arXiv:2306.17439. · arXiv

Cited by

Sorted by citations

Metadata

Authors
Hou, A. B., Zhang, J., He, T., Wang, Y., Chuang, Y.-S., Wang, H., Shen, L., Van Durme, B., Khashabi, D., & Tsvetkov, Y.
Affiliations
  • Johns Hopkins University (US)
  • Massachusetts Institute of Technology (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2023
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2310.03991
arXiv
2310.03991
OpenAlex
W4394652422
Cited by
3
References
0
Citations by year
2025: 3
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • National Science Foundation (2125201, 2142739, 2203097, CAREER)
  • Alfred P. Sloan Foundation
  • Office of the Director of National Intelligence
  • Defense Advanced Research Projects Agency (HR001120C0124)
  • Intelligence Advanced Research Projects Activity
Topics
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
Keywords
text generation, locality-sensitive hashing, rejection sampling, large language models, semantic embedding space

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review