Topic-Based Watermarks for Large Language Models

arXiv:2404.02138 · cs.CR, cs.CL, cs.LG · Submitted 2024-04-02 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Hi, I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We're looking at the paper: "Topic-Based Watermarks for Large Language Models".

Elias: Here's the gist of the paper. The gist The proposed Topic-Based Watermarking (TBW) scheme offers a lightweight, topic-guided method for embedding detectable signatures into Large Language Model output by partitioning vocabulary into topic-aligned token subsets based on an input prompt's semantics.

Nadia: The indistinguishability of large language model output from human-authored content poses significant challenges, raising concerns about potential misuse of AIgenerated text and its influence on future model training The rapid expansion of Large Language Model (LLM) capabilities has led to unprecedented accuracy and fluency in tasks such as text generation, summarization, and dialogue While these advancements offer significant benefits across multiple domains, they also pose security and ethical challenges One central issue is the misuse of LLM-generated text for malicious purposes, such as misinformation, copyright infringement, or plagiarism Topic-Based Watermarking (TBW) Mechanism The TBW scheme partitions the vocabulary into topic-aligned token subsets to embed robust marks while preserving fluency and coherence Specifically, for each token v, the similarity sim(v, ti) is computed against topic embeddings eti with a threshold τ; if sim(v, ti) ≥ τ for some topic ti, then v is appended to ti’s list Gti as the “green list” for ti During generation, the scheme identifies relevant topics from the input prompt xprompt using a lightweight topic extraction model and uses k-means clustering to map them to the closest predefined topic if no direct match is found, yielding a single “green list” Gt∗ At each generation step, a small bias δ is added to all tokens v in Gt∗ before normalization with softmax, which raises the selection probability of tokens in Gt∗ Threat Model and Robustness The threat model assumes a standard black-box adversary seeking to remove watermarks while preserving semantic fidelity The scheme addresses two primary attack surfaces: (1) text degradation via tokenlevel perturbations that disrupt the watermark signal at the cost of fluency, and (2) semantic rephrasing using external models for paraphrasing or summarization to rewrite content while maintaining meaning Robustness experiments show that TBW maintains higher detection rates across all perturbation levels for both random and targeted attacks compared to other schemes Furthermore, partition recovery attacks are shown to be unrecoverable because the full partition remains unrecoverable without the private random seed used during round-robin distribution of residual tokens Detection Schemes Three detection schemes are proposed with increasing robustness and decreasing reliance on perfect topic knowledge 1.

Elias: Strict Topic Matching assumes consistent topic alignment between generation and detection phases, using hierarchical matching strategies like embedding averaging or k-means clustering to select the active green list Gt∗ 2.

Nadia: Sliding Window Detection partitions the input text into windows of size w and assigns a final topic via majority voting, which addresses local topic inconsistencies while maintaining semantic awareness 3.

Title and authors: Nadia: So we're looking at this paper today called "Topic-Based Watermarks for Large Language Models." It sounds like they're trying to fix the problem where it's hard to tell if text came from a person or an AI.

Elias: Yeah, the authors are Alexander Nemecek and Yuzhou Jiang, and they're tackling that problem by using something called topic-based watermarking. It’s basically about embedding detectable signatures into AI-generated text based on what the input prompt is about.

Nadia: That's right. The implication here is that instead of just sprinkling random noise everywhere, they are trying to be smarter about *where* they put the mark, so it stays useful and doesn't ruin how good the generated text sounds.

Elias: Exactly. It’s about selecting a relevant topic-specific token list during generation, which they call "green-listing" semantically aligned tokens to embed robust marks while preserving fluency and coherence >

Priya: From what I see on the setup, it seems like they're starting with a predefined set of topics and then sorting every single token based on how similar it is to those topic embeddings using a similarity measure, sim(v, ti) = ev · eti∥ev∥∥eti ∥ >

Nadia: Right. And if that similarity score is above some threshold tau, like zero point seven, the token gets added to that topic's list as the "green list" for ti >

Elias: That threshold tau determines which tokens actually get marked with a signal, and tokens that don't meet it are just distributed among all topic lists in a round-robin fashion >

Priya: So it’s a filtering process based on semantic similarity before generation even starts, which seems like the key to making the mark specific to the content.

Nadia: And then when they actually generate text from that prompt, they use a lightweight topic extraction model to find relevant topics and map those detected topics to their closest predefined topic >

Elias: They select one active "green list" for generation, which is Gt*, and then they add a small bias delta, delta, to all the tokens in that list before applying softmax normalization >

The paper's summary: Nadia: So what's the actual summary of this Topic-Based Watermarks for Large Language Models paper? It seems like it’s focusing heavily on how they manage that trade-off between making the watermark strong and keeping the text high quality.

Elias: They’re proposing a method called Topic-Based Watermarking, or TBW, which addresses the issue where existing watermarking techniques often involve things like costly architectural modifications or multiple inference passes that degrade practical deployability >

Nadia: Right. They argue that instead of those heavy methods, they can integrate semantic information directly into the watermarking process while keeping the generation pipeline simple >

Priya: They test this on robustness against paraphrasing attacks and lexical perturbations, showing that TBW maintains text quality comparable to industry-leading systems even while improving robustness against these types of attacks >

Elias: That’s significant because it suggests you can get better detection accuracy without adding extra inference steps beyond the standard generation pipeline >

Nadia: They also mention that they evaluate this on several large language models and state-of-the-art benchmarks, showing text quality with perplexity on par with current production-grade systems >

Priya: So, before we get into how they make it better, the core summary is that TBW successfully embeds robust signals that resist paraphrasing attacks without sacrificing the fluency of the output >

Nadia: And they also show performance improvements across various detection schemes, which is important for deployment because you don't always have perfect topic knowledge on your end >

Elias: Right, so it’s not just about embedding a mark; it’s about embedding a mark that survives attacks while staying consistent with the model's output quality >

The paper's improvements: Nadia: Now let's talk about what the authors actually suggest as improvements over older watermarking schemes. It seems they focus on how they handle the generation process itself >

Elias: They propose that instead of random partitioning, you map tokens to predefined topic embeddings first, which is a key difference from prior work like KGW >

Nadia: And they detail the process: first identifying relevant topics from your input prompt, then selecting the corresponding semantically aligned "green" token list based on that prompt >

Priya: That means the system selects a specific topic-aligned list, Gt*, during generation, and then adds a small bias delta to those tokens before they are normalized by softmax >

Elias: This semantic alignment is what preserves fluency while embedding the robust watermark signals that resist paraphrasing attacks >

Nadia: They also mention that their method allows for flexible topic alignment by mapping tokens to predefined topic embeddings and selecting the green list based on user prompts >

Priya: That flexibility, combined with their detection schemes, like the maximum z-score detection, lets them achieve near-perfect separation between watermarked and non-watermarked content even under strong adversarial attacks >

Elias: And they show that scaling the number of topics K doesn't hurt text quality; for example, BERTScore F1 remains flat as K increases, indicating no degradation as K increases with scores remaining flat with low variability >

Nadia: So the improvement is that you can tune the strength of detection versus text quality by changing how many topics you use >

Conclusion: Nadia: We’ve looked at the Topic-Based Watermarks for Large Language Models paper. Basically, it shows a way to embed detectable signatures using topic-guided token partitioning that keeps generation quality high while improving robustness against attacks >

Elias: The main implication is that you can get strong detection accuracy without needing extra inference steps beyond standard generation pipelines >

Priya: From my side, I think the results showing TBW maintains high text quality while achieving robustness closer to heavyweight schemes without their quality degradation is what really matters for practical deployment >

Nadia: Right. And they also show that they can tune the strength of detection versus text quality by varying the number of topics K in the predefined set >

Elias: So, overall, this work suggests a practical path toward deployable watermarking by balancing robustness and computational cost with generation speed >

Priya: I just think it’s solid, but we do have to remember their limitation that the statistical nature of zscore-based detection requires sufficient tokens to distinguish the watermark signal from random variation, which means detection performance would degrade on shorter sequences >

Nadia: That’s a fair point. So we've seen a method that balances text quality and robustness, but it doesn't work perfectly if you only have very short sequences >

Elias: We’ve covered the topic-based watermarking scheme today, which is titled "Topic-Based Watermarks for Large Language Models" >

Nadia: That’s all we have for this paper. We'll move on to the next one soon.

Alexander Nemecek, Yuzhou Jiang, Erman Ayday

Case Western Reserve University · Meta Platforms, Inc.

cs.CR, cs.CL, cs.LG

Submitted: 2024-04-02

Updated: 2026-10-17

Comments: Accepted at ACL 2026 Findings

Code: https://github.com/ANCP2021/Topic-Based-Watermarks

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 92/100

The gist: The gist The proposed Topic-Based Watermarking (TBW) scheme offers a lightweight, topic-guided method for embedding detectable signatures into Large Language Model output by partitioning vocabulary

Key concepts

Topic-Based Watermarking (TBW): A scheme that partitions the entire vocabulary into subsets aligned with specific semantic topics derived from an input prompt. During generation, the model is biased toward tokens belonging to a selected 'green list' associated with those topics, embedding a detectable signal.
Green List (Gt): A topic-aligned subset of vocabulary for each predefined topic. Tokens that are semantically similar to a specific topic embedding are included in this list. The generation process prioritizes these tokens, ensuring the output reflects the intended semantic theme guided by the input prompt.
Maximum z-Score Detection: A detection method that evaluates generated text against every predefined topic's green list and selects the token with the highest statistical score (z-score). This approach is highly robust against topic misalignment, making it effective even when the exact topic alignment between generation and detection is imperfect.
Topic Scalability (K): The number of predefined topics ($K$) used in the watermarking scheme. Varying $K$ allows practitioners to tune the trade-off between detection strength and text quality. The paper shows that performance metrics remain relatively stable across different values of $K$, indicating flexible deployment options.

Terminology

Robustness — 2× in this paper · explained in 6 episodes
Benchmark — 1× in this paper · explained in 2 episodes
Coherence — 1× in this paper · explained in 2 episodes
Large Language Model (LLM) — 1× in this paper · explained in 3 episodes

Summary

The gist The proposed Topic-Based Watermarking (TBW) scheme offers a lightweight, topic-guided method for embedding detectable signatures into Large Language Model output by partitioning vocabulary into topic-aligned token subsets based on an input prompt's semantics.

Introduction and Motivation

The indistinguishability of large language model output from human-authored content poses significant challenges, raising concerns about potential misuse of AIgenerated text and its influence on future model training The rapid expansion of Large Language Model (LLM) capabilities has led to unprecedented accuracy and fluency in tasks such as text generation, summarization, and dialogue While these advancements offer significant benefits across multiple domains, they also pose security and ethical challenges One central issue is the misuse of LLM-generated text for malicious purposes, such as misinformation, copyright infringement, or plagiarism

Topic-Based Watermarking (TBW) Mechanism

The TBW scheme partitions the vocabulary into topic-aligned token subsets to embed robust marks while preserving fluency and coherence Specifically, for each token v, the similarity sim(v, ti) is computed against topic embeddings eti with a threshold τ; if sim(v, ti) ≥ τ for some topic ti, then v is appended to ti’s list Gti as the “green list” for ti During generation, the scheme identifies relevant topics from the input prompt xprompt using a lightweight topic extraction model and uses k-means clustering to map them to the closest predefined topic if no direct match is found, yielding a single “green list” Gt∗ At each generation step, a small bias δ is added to all tokens v in Gt∗ before normalization with softmax, which raises the selection probability of tokens in Gt∗

Threat Model and Robustness

The threat model assumes a standard black-box adversary seeking to remove watermarks while preserving semantic fidelity The scheme addresses two primary attack surfaces: (1) text degradation via tokenlevel perturbations that disrupt the watermark signal at the cost of fluency, and (2) semantic rephrasing using external models for paraphrasing or summarization to rewrite content while maintaining meaning Robustness experiments show that TBW maintains higher detection rates across all perturbation levels for both random and targeted attacks compared to other schemes Furthermore, partition recovery attacks are shown to be unrecoverable because the full partition remains unrecoverable without the private random seed used during round-robin distribution of residual tokens

Detection Schemes

Three detection schemes are proposed with increasing robustness and decreasing reliance on perfect topic knowledge

Strict Topic Matching assumes consistent topic alignment between generation and detection phases, using hierarchical matching strategies like embedding averaging or k-means clustering to select the active green list Gt∗
Sliding Window Detection partitions the input text into windows of size w and assigns a final topic via majority voting, which addresses local topic inconsistencies while maintaining semantic awareness
Maximum z-Score Detection eliminates the topic matching assumption entirely by evaluating text against each predefined green list Gti and selecting the maximum z-score across all topics, providing robustness against topic ambiguity and misalignment

Evaluation Results

Experimental results show that TBW achieves text quality comparable to industry-leading systems and simultaneously improves watermark robustness against paraphrasing and lexical perturbation attacks with minimal performance overhead Perplexity metrics indicate that TBW achieves significantly lower perplexity compared to other watermarking schemes, such as SynthID, closely matching non-watermarked outputs In terms of robustness against semantic paraphrasing using PEGASUS and DIPPER, TBW and Unigram retain the highest ROC-AUC and Best F1 scores across both attack scenarios The maximum z-score detection method delivers near-perfect results, achieving 99.6% and 100% detection rates for OPT-6.7B and GEMMA-7B, with the highest mean z-scores

Efficiency and Scalability

TBW introduces negligible overhead compared to non-watermarked generation, matching lightweight methods such as KGW and SynthID The detection runtime scales approximately linearly with K (the number of topics), but this overhead remains tractable for offline deployment Scaling the number of topics from K = 4 to K = 32 on GEMMA-7B shows that detection strength decreases gracefully, yet text quality remains flat across all K values

Conclusion

Topic-Based Watermarking (TBW) addresses the trade-off between robustness, computational cost, and text quality by embedding semantically aligned signals through topic-driven token partitioning TBW preserves the speed and fluency of lightweight approaches while achieving robustness closer to heavyweight schemes Our evaluation confirms that TBW provides strong detection accuracy, resilience to lexical and semantic attacks, and negligible runtime overhead By overcoming this trade-off, TBW offers a practical path toward deployable watermarking.

Limitations

Our results indicate that models with smaller vocabularies may exhibit slightly reduced performance compared to larger vocabulary models Furthermore, the statistical nature of zscore-based detection requires sufficient tokens to distinguish the watermark signal from random variation, suggesting that detection performance would degrade on shorter sequences

Ethical Considerations

Watermarking techniques inherently carry dual-use risks, and we recommend deployment with conservative thresholds and transparent documentation of error rates

--- Page 31 ---

The paper is titled Topic-Based Watermarks for Large Language Models. It is a scientific paper that proposes a lightweight, topic-guided watermarking scheme for LLMs to embed detectable signatures into generated text by partitioning the vocabulary based on semantic topics derived from an input prompt. This method is important because it balances the need for robust watermark detection against the requirements of generation quality and computational efficiency in real-world applications.

How it works

Token-to-Topic Mappings: Tokens are clustered into semantically aligned lists Gti based on similarity sim(v, ti) to predefined topic embeddings eti Tokens exceeding a threshold τ are assigned to the corresponding topic’s “green list” Gti, while residual tokens are distributed among all topic lists in a round-robin fashion
Topic Selection: Given an input prompt xprompt, relevant topics Tdetected are extracted using KeyBERT, and the system selects the corresponding list Gt∗ based on semantic matching or clustering of detected topic embeddings
Watermark Embedding: A small bias δ is added to all tokens v in Gt∗ before softmax normalization, biasing generation toward the selected topic-aligned list

Detection Schemes

Strict Topic Matching: This scheme assumes consistent topic alignment between input and output, using hierarchical matching strategies like embedding averaging or k-means clustering to select the active green list Gt∗
Sliding Window Detection: This approach partitions text into windows of size w and assigns a final topic via majority voting, which addresses local topic inconsistencies while maintaining semantic awareness
Maximum z-Score Detection: This scheme evaluates text against each predefined green list Gti and selects the maximum z-score across all topics, providing robustness against topic ambiguity and misalignment

Evaluation Summary

TBW achieves optimal balance across four key dimensions: text quality, robustness against both fulltext paraphrasing and lexical perturbations, evaluation of watermark detection performance under our proposed schemes, and computational efficiency via average generation times TBW maintains high text quality while achieving robustness closer to heavyweight schemes without their quality degradation

Practical Recommendations

For most deployment scenarios, we recommend δ = 2.0-3.0, which sits just before the diversity inflection point in Figure 13 and well past the detection saturation zone in Figure 12 A similarity threshold of τ = 0.7 provides optimal semantic coherence without sacrificing detection capability

Overall Comparison

Across all metrics, TBW strikes the most favorable balance relative to prior watermarking schemes, closing much of the gap to heavyweight approaches while maintaining negligible generation overhead

The gist

The proposed Topic-Based Watermarking (TBW) scheme offers a lightweight, topic-guided method for embedding detectable signatures into Large Language Model output by partitioning vocabulary into topic-aligned token subsets based on an input prompt's semantics.

How it works

Improvements for AI systems

Topic-based watermarking allows for embedding detectable signatures by selecting a relevant topicspecific token list during generation, which means the improved AI system can maintain text quality comparable to industry-leading systems while simultaneously improving watermark robustness against paraphrasing and lexical perturbation attacks.
The method enables flexible topic alignment by mapping tokens to predefined topic embeddings and selecting the corresponding green list based on user prompts, allowing the system to embed robust watermark signals that resist paraphrasing attacks without requiring additional inference steps beyond standard generation pipelines.
The system can be deployed with a maximum z-score detection scheme, which is best suited for general deployment where access to input prompts cannot be assumed, enabling near-perfect separation between watermarked and non-watermarked content even under strong adversarial attacks.
Topic scalability can be managed by varying the number of topics K in the predefined set, allowing practitioners to choose a balance between detection strength and text quality, as BERTScore F1 remains flat as K increases, indicating no degradation as K increases with scores remaining flat with low variability.
The system can perform summarization tasks on specialized domains by using topic-based watermarking aligned with domain-specific topics, where the paper shows that TBW summaries demonstrate superior performance across all ROUGE metrics compared to non-watermarked baselines.

Abstract

The indistinguishability of large language model (LLM) output from human-authored content poses significant challenges, raising concerns about potential misuse of AI-generated text and its influence on future model training. Watermarking algorithms offer a viable solution by embedding detectable signatures into generated text. However, existing watermarking methods often involve trade-offs among attack robustness, generation quality, and additional overhead such as specialized frameworks or complex integrations. We propose a lightweight, topic-guided watermarking scheme for LLMs that partitions the vocabulary into topic-aligned token subsets. Given an input prompt, the scheme selects a relevant topic-specific token list, effectively "green-listing" semantically aligned tokens to embed robust marks while preserving fluency and coherence. Experimental results across multiple LLMs and state-of-the-art benchmarks demonstrate that our method achieves text quality comparable to industry-leading systems and simultaneously improves watermark robustness against paraphrasing and lexical perturbation attacks, with minimal performance overhead. Our approach avoids reliance on additional mechanisms beyond standard text generation pipelines, enabling straightforward adoption and suggesting a practical path toward globally consistent watermarking of AI-generated content.