{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/a-private-watermark-for-large-language-models","title":"An Unforgeable Publicly Verifiable Watermark for Large Language Models","arxiv_id":"2307.16230","date":"2023-07-30","proceeding":null,"authors":["Aiwei Liu","Leyi Pan","Xuming Hu","Shu'ang Li","Lijie Wen","Irwin King","Philip S. Yu"],"abstract":"Recently, text watermarking algorithms for large language models (LLMs) have been proposed to mitigate the potential harms of text generated by LLMs, including fake news and copyright issues. However, current watermark detection algorithms require the secret key used in the watermark generation process, making them susceptible to security breaches and counterfeiting during public detection. To address this limitation, we propose an unforgeable publicly verifiable watermark algorithm named UPV that uses two different neural networks for watermark generation and detection, instead of using the same key at both stages. Meanwhile, the token embedding parameters are shared between the generation and detection networks, which makes the detection network achieve a high accuracy very efficiently. Experiments demonstrate that our algorithm attains high detection accuracy and computational efficiency through neural networks. Subsequent analysis confirms the high complexity involved in forging the watermark from the detection network. Our code is available at \\href{https://github.com/THU-BPM/unforgeable_watermark}{https://github.com/THU-BPM/unforgeable\\_watermark}. Additionally, our algorithm could also be accessed through MarkLLM \\citep{pan2024markllm} \\footnote{https://github.com/THU-BPM/MarkLLM}.","url_abs":"https://arxiv.org/abs/2307.16230v7","url_pdf":"https://arxiv.org/pdf/2307.16230v7.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"a-private-watermark-for-large-language-models","repo_url":"https://github.com/THU-BPM/private_watermark","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"a-private-watermark-for-large-language-models","repo_url":"https://github.com/thu-bpm/markllm","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"a-private-watermark-for-large-language-models","repo_url":"https://github.com/thu-bpm/unforgeable_watermark","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"computational-efficiency","task_name":"Computational Efficiency"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2307.16230","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2307.16230"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thu-bpm/unforgeable_watermark","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/THU-BPM/private_watermark","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thu-bpm/markllm","reach":null}],"summary":{"ran":1,"ran_honours":2,"ran_violates":1,"ran_draft_wrong":1,"unverified":1},"by_repo_kind":{"official":{"samples":6,"ran":5,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":6,"samples":[{"code_sha256_prefix":"65185c4473a306e7","entry":"get_model","repo":"THU-BPM/private_watermark","repo_kind":"official","path":"model_key.py","file_url":"https://github.com/THU-BPM/private_watermark/blob/HEAD/model_key.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"65185c4473a306e7"}},{"code_sha256_prefix":"1fb15ca9454bd015","entry":"int_to_bin_list","repo":"thu-bpm/unforgeable_watermark","repo_kind":"official","path":"watermark_model.py","file_url":"https://github.com/thu-bpm/unforgeable_watermark/blob/HEAD/watermark_model.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1fb15ca9454bd015"}},{"code_sha256_prefix":"6d408bb6dfdb2d3d","entry":"max_number","repo":"thu-bpm/unforgeable_watermark","repo_kind":"official","path":"generate_data.py","file_url":"https://github.com/thu-bpm/unforgeable_watermark/blob/HEAD/generate_data.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6d408bb6dfdb2d3d"}},{"code_sha256_prefix":"9d2aa314b6f22d08","entry":"pad_sequence_to_fixed_length","repo":"thu-bpm/unforgeable_watermark","repo_kind":"official","path":"detector.py","file_url":"https://github.com/thu-bpm/unforgeable_watermark/blob/HEAD/detector.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9d2aa314b6f22d08"}},{"code_sha256_prefix":"a9b110ac99734343","entry":"train_collate_fn","repo":"thu-bpm/unforgeable_watermark","repo_kind":"official","path":"detector.py","file_url":"https://github.com/thu-bpm/unforgeable_watermark/blob/HEAD/detector.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a9b110ac99734343"}},{"code_sha256_prefix":"3ccef01627eeebef","entry":"get_value","repo":"THU-BPM/private_watermark","repo_kind":"official","path":"model_key.py","file_url":"https://github.com/THU-BPM/private_watermark/blob/HEAD/model_key.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3ccef01627eeebef"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}