{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/a-semantic-invariant-robust-watermark-for","title":"A Semantic Invariant Robust Watermark for Large Language Models","arxiv_id":"2310.06356","date":"2023-10-10","proceeding":null,"authors":["Aiwei Liu","Leyi Pan","Xuming Hu","Shiao Meng","Lijie Wen"],"abstract":"Watermark algorithms for large language models (LLMs) have achieved extremely high accuracy in detecting text generated by LLMs. Such algorithms typically involve adding extra watermark logits to the LLM's logits at each generation step. However, prior algorithms face a trade-off between attack robustness and security robustness. This is because the watermark logits for a token are determined by a certain number of preceding tokens; a small number leads to low security robustness, while a large number results in insufficient attack robustness. In this work, we propose a semantic invariant watermarking method for LLMs that provides both attack robustness and security robustness. The watermark logits in our work are determined by the semantics of all preceding tokens. Specifically, we utilize another embedding LLM to generate semantic embeddings for all preceding tokens, and then these semantic embeddings are transformed into the watermark logits through our trained watermark model. Subsequent analyses and experiments demonstrated the attack robustness of our method in semantically invariant settings: synonym substitution and text paraphrasing settings. Finally, we also show that our watermark possesses adequate security robustness. Our code and data are available at \\href{https://github.com/THU-BPM/Robust_Watermark}{https://github.com/THU-BPM/Robust\\_Watermark}. Additionally, our algorithm could also be accessed through MarkLLM \\citep{pan2024markllm} \\footnote{https://github.com/THU-BPM/MarkLLM}.","url_abs":"https://arxiv.org/abs/2310.06356v3","url_pdf":"https://arxiv.org/pdf/2310.06356v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"a-semantic-invariant-robust-watermark-for","repo_url":"https://github.com/thu-bpm/markllm","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"a-semantic-invariant-robust-watermark-for","repo_url":"https://github.com/thu-bpm/robust_watermark","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2310.06356","atlas_url":"https://app.syntology.ai/?focus=2310.06356","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.06356"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thu-bpm/robust_watermark","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thu-bpm/markllm","reach":null}],"summary":{"ran_honours":3},"by_repo_kind":{"official":{"samples":3,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"bfd0c083d141f8bc","entry":"abs_value_penalty","repo":"thu-bpm/robust_watermark","repo_kind":"official","path":"train_watermark_model.py","file_url":"https://github.com/thu-bpm/robust_watermark/blob/HEAD/train_watermark_model.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bfd0c083d141f8bc"}},{"code_sha256_prefix":"2a673044a613aa62","entry":"cosine_similarity","repo":"thu-bpm/robust_watermark","repo_kind":"official","path":"train_watermark_model.py","file_url":"https://github.com/thu-bpm/robust_watermark/blob/HEAD/train_watermark_model.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2a673044a613aa62"}},{"code_sha256_prefix":"b775e4c71d0af9d1","entry":"row_col_mean_penalty","repo":"thu-bpm/robust_watermark","repo_kind":"official","path":"train_watermark_model.py","file_url":"https://github.com/thu-bpm/robust_watermark/blob/HEAD/train_watermark_model.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b775e4c71d0af9d1"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}