Pith. sign in

REVIEW 10 cited by

A Semantic Invariant Robust Watermark for Large Language Models

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2310.06356 v3 pith:ZUMCUVBK submitted 2023-10-10 cs.CR cs.CL

Aiwei Liu , Leyi Pan , Xuming Hu , Shiao Meng , Lijie Wen This is my paper
classification cs.CRcs.CL
keywords watermarkrobustnesslogitsattacksecuritysemanticalgorithmsgithub
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Watermark algorithms for large language models (LLMs) have achieved extremely high accuracy in detecting text generated by LLMs. Such algorithms typically involve adding extra watermark logits to the LLM's logits at each generation step. However, prior algorithms face a trade-off between attack robustness and security robustness. This is because the watermark logits for a token are determined by a certain number of preceding tokens; a small number leads to low security robustness, while a large number results in insufficient attack robustness. In this work, we propose a semantic invariant watermarking method for LLMs that provides both attack robustness and security robustness. The watermark logits in our work are determined by the semantics of all preceding tokens. Specifically, we utilize another embedding LLM to generate semantic embeddings for all preceding tokens, and then these semantic embeddings are transformed into the watermark logits through our trained watermark model. Subsequent analyses and experiments demonstrated the attack robustness of our method in semantically invariant settings: synonym substitution and text paraphrasing settings. Finally, we also show that our watermark possesses adequate security robustness. Our code and data are available at \href{https://github.com/THU-BPM/Robust_Watermark}{https://github.com/THU-BPM/Robust\_Watermark}. Additionally, our algorithm could also be accessed through MarkLLM \citep{pan2024markllm} \footnote{https://github.com/THU-BPM/MarkLLM}.

Discussion (0). Sign in to comment.

Forward citations

Cited by 10 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. SLAM: Structural Linguistic Activation Marking for Language Models

    cs.CL 2026-05 unverdicted novelty 8.0 of 10

    SLAM achieves 100% detection accuracy on Gemma-2 models with only 1-2 points of quality loss by causally steering SAE-identified structural directions while preserving lexical sampling and semantics.

  2. SLAM: Structural Linguistic Activation Marking for Language Models

    cs.CL 2026-05 unverdicted novelty 8.0 of 10

    SLAM achieves 100% detection on Gemma-2 models with only 1-2 point quality cost by causally steering SAE-identified residual-stream directions for linguistic structure.

  3. RLCracker: Evaluating the Worst-Case Vulnerability of LLM Watermarks with Adaptive RL Attacks

    cs.CR 2025-09 conditional novelty 8.0 of 10

    RLCracker is a reinforcement learning attack that erases LLM watermarks at 98.5% success rate with minimal data and generalizes across ten schemes and multiple model sizes.

  4. WaterMoE: Expert-Routing-based Watermarking for High Fidelity and Efficiency

    cs.CR 2026-07 conditional novelty 7.0 of 10

    WaterMoE watermarks MoE LLMs by adding a small secret bias to router expert selection, claiming near-zero quality loss, ~1% latency overhead, and strong detection.

  5. SWAN: Semantic Watermarking with Abstract Meaning Representation

    cs.CL 2026-05 unverdicted novelty 7.0 of 10

    SWAN uses AMR to embed semantic watermarks that persist through paraphrases, matching SOTA detection on original text and improving AUC by 13.9 points on paraphrased RealNews data.

  6. Context-Fidelity Boosting: Enhancing Faithful Generation through Watermark-Inspired Decoding

    cs.CL 2026-04 unverdicted novelty 7.0 of 10

    Context-Fidelity Boosting reduces faithfulness hallucinations by applying context-based logit boosts to source-supported tokens during LLM decoding.

  7. Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigm

    cs.CR 2025-09 conditional novelty 7.0 of 10

    A trigger-tag watermark embedded by fine-tuning lets modified LLMs mark their own phishing outputs for cheap detection.

  8. Topic-Based Watermarks for Large Language Models

    cs.CR 2024-04 unverdicted novelty 7.0 of 10

    A topic-guided watermarking scheme partitions the LLM vocabulary into topic-aligned token subsets and green-lists relevant tokens based on the input prompt to embed detectable marks while preserving text quality and i...

  9. TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

    cs.CR 2026-05 unverdicted novelty 6.0 of 10

    TextSeal provides a localized, distortion-free LLM watermark that enables provenance tracking and distillation detection while preserving performance and text quality.

  10. TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

    cs.CR 2026-05 unverdicted novelty 6.0 of 10

    TextSeal provides a localized, distortion-free LLM watermark that outperforms baselines in detection strength, remains effective in mixed human-AI text, preserves model performance, and transfers through distillation ...

Pith tools