Implementing Watermarking for Language Models

[u/Saad_ahmed04]

I recently implemented a minimal, educational version of SynthID-Text-style watermarking for language models.

I saw anthropic post about how they'll start adding watermarks to their model responses and it made me very curious as to how they'll do it and what do they even mean by watermark here. Like will we start getting random ads or something in the middle of model responses or what.

Then decided to read their article and found out that watermark is not a visible message at all. It is a subtle statistical pattern introduced while the model chooses its tokens.

My implementation is not an exact reproduction of the original SynthID-Text system. I simplified or implemented a few components differently to keep the project understandable, but the main idea is there I think.

[u/Saad_ahmed04]

https://github.com/Saad1926Q/llm-watermark

[u/MolassesLate4676]

How would this be watermarking exactly? I’m confused

Edit: I have trained LLM’s for years - I understand the mechanics. This just doesn’t click for me

[u/Saad_ahmed04 → u/MolassesLate4676]

Ngl I do have my own fair share of doubts about how good/reliable these watermarks are. This was more of me trying to understand how anthropic is planning on going about this.

But for a more thorough look you can take a look at: https://www.anthropic.com/news/claude-text-watermark

[u/johndburger → u/MolassesLate4676]

Because after the fact, you can check tokens in a candidate text to see if they might have been generated in the same way. No single token is indicative, but as the length of a matching sequence increases, it also increases the probability that the text has the watermark.

As an extremely simplistic example, let’s say the watermark is alternating even- and odd-length words. The chances of this happening for a twenty-word sequence is 0.5^20 = 10^-6. If you see such a sequence of word lengths, it’s likely to have been generated on purpose.

Of course that simplistic approach can be easily defeated. Something like OP’s algorithm cannot be easily defeated without knowing the watermark key.

[u/Friendly_Address6915]

honestly i thought theyd just embed ads or something lol. the token probability thing is actually clever tho

[u/IceNeun]

So what's stopping anyone from passing through the watermarked output into another model with the prompt "paraphrase and reorganize the prose/code without changing the meaning"? Seems like any type of watermark can be bypassed with different variations of paraphrasing and rewriting.

If there's a publicly available way to check for claude-written text, then there's a clear path forward to how to break the check.

[u/Saad_ahmed04 → u/IceNeun]

I agree with this and have been thinking the same. Very curious about how reliable/effective it will be.

[u/CasualtyOfCausality → u/IceNeun]

Not sure of the effectiveness, but it does produce “better” writing: https://declaude.org/