VOW: Verifiable and Oblivious Watermark Detection for Large Language Models
VOW employs VOPRF for privacy-preserving, verifiable watermark detection in short texts, enhancing security and trustworthiness.
Key Findings
Methodology
VOW formulates watermark detection as a secure two-party computation problem, leveraging a Verifiable Oblivious Pseudorandom Function (VOPRF). During setup, the provider generates a cryptographic key pair; during insertion, the provider adjusts token logits based on VOPRF evaluations to embed watermarks; during detection, a client and server interact via a protocol where the client blinds inputs, the server evaluates with the secret key and provides cryptographic proofs, and the client verifies and performs statistical testing. This approach guarantees privacy of user input and verifiability of detection results, optimized for short texts.
Key Results
- Experimental results show that VOW achieves over 85% detection accuracy on short texts like code snippets and summaries, with robustness against paraphrasing attacks maintaining over 80% success rate. It reduces detection time to approximately 200ms per sample and communication overhead by 30%, outperforming traditional schemes in efficiency and security.
- Security analysis confirms that malicious providers cannot forge detection results, and user privacy is protected through cryptographic guarantees. The scheme's robustness was validated against multiple paraphrasing strategies, demonstrating strong resistance in practical scenarios.
- Overall, VOW provides a practical, secure, and efficient solution for short-text watermark detection, suitable for real-world AI content auditing and accountability.
Significance
This work bridges a critical gap in AI content security by enabling privacy-preserving, cryptographically verifiable watermark detection for short texts. It addresses the limitations of prior schemes that either compromised privacy or lacked formal security guarantees, thus facilitating trustworthy AI content attribution, copyright enforcement, and model accountability. The integration of cryptographic primitives into watermarking protocols marks a significant advancement, offering industry-ready solutions for AI governance and regulation. Its applicability extends to multi-provider environments, ensuring content provenance without risking sensitive data exposure, thereby strengthening the trust and transparency in AI-generated content.
Technical Contribution
The paper introduces a novel protocol that embeds watermark detection within a cryptographic framework based on VOPRF, transforming the process into a secure two-party computation. This guarantees privacy and verifiability simultaneously, a feat not achieved by prior symmetric or public-key schemes, especially in short text scenarios. The design incorporates efficient algorithms and cryptographic proofs, enabling practical deployment with minimal overhead. This approach sets a new standard for secure AI content attribution, combining cryptography with natural language processing.
Novelty
VOW's primary innovation is the application of VOPRF-based point function evaluation for watermark detection, enabling privacy-preserving and verifiable detection in short texts. Unlike previous methods relying on long sequences or trust assumptions, this is the first scheme to formalize and implement cryptographically secure detection tailored for short, real-world texts. It effectively bridges cryptography and NLP, providing a scalable, secure, and practical solution that addresses a longstanding challenge in AI content security.
Limitations
- While effective against paraphrasing, VOW's robustness may diminish under highly aggressive semantic rewriting, requiring further integration with semantic preservation techniques.
- The computational overhead, though optimized, still poses challenges for extremely large vocabularies or high-frequency detection scenarios, necessitating hardware acceleration or further algorithmic improvements.
- The security model assumes classical cryptographic assumptions; future work should consider quantum-resistant primitives to ensure long-term security.
Future Work
Future research will explore multi-modal watermarking integrating visual and audio signals, enhance robustness against complex semantic attacks via deep learning, and optimize protocols for large-scale deployment. Additionally, establishing industry standards and extending cryptographic guarantees to quantum-resistant schemes will be prioritized to ensure long-term security and applicability.
AI Executive Summary
The rapid proliferation of large language models (LLMs) like GPT-4 has revolutionized content creation, but it also raises critical concerns about content provenance, accountability, and security. Existing watermarking techniques, such as the Green-Red scheme, embed statistical signals into generated text to trace origins. However, these methods often rely on trust assumptions, exposing user data and lacking formal guarantees of detection integrity. To address these challenges, this paper introduces VOW, a novel watermark detection protocol based on cryptographic primitives, specifically the Verifiable Oblivious Pseudorandom Function (VOPRF). VOW transforms the detection process into a secure two-party computation, allowing users and providers to collaborate without revealing sensitive input data, while ensuring the provider's detection result is cryptographically verifiable. This approach is particularly effective for short texts, such as code snippets, summaries, or conversational turns, where traditional cryptographic schemes struggle to embed sufficient cryptographic payloads.
Experimental evaluations demonstrate that VOW maintains high detection accuracy (>85%) even under paraphrasing attacks, significantly outperforming existing methods. The protocol achieves detection times within 200 milliseconds per sample and reduces communication overhead by 30%, making it suitable for real-world deployment. Security analysis confirms that malicious providers cannot forge detection results, and user privacy remains protected through cryptographic proofs. The robustness tests against modern paraphrasing strategies further validate its practical applicability.
This work represents a significant step forward in AI content security, providing a scalable, privacy-preserving, and cryptographically sound solution for content attribution and auditing. Its implications extend to copyright enforcement, model accountability, and regulatory compliance, fostering greater trust in AI-generated content. Future directions include multi-modal watermarking, deep learning-based robustness enhancement, and large-scale deployment optimizations, aiming to establish industry standards for trustworthy AI content management.
Deep Analysis
Background
随着GPT-4等大规模语言模型的崛起，内容生成的效率和规模达到了前所未有的水平。然而，随之而来的内容责任追溯、版权保护和滥用问题也日益突出。早期的水印技术如 Kirchenbauer 提出的Green-Red方案，通过在输出中引入统计信号实现内容追溯，已成为主流。尽管如此，这些方案多依赖信任模型提供者，缺乏隐私保护和正式的安全保证，难以满足实际审计需求。近年来，研究逐步关注在短文本场景下的隐私保护和安全验证，试图突破传统方案的局限。
Core Problem
现有水印检测方法在隐私保护和验证方面存在明显不足。对称方案要求用户泄露内容，无法实现盲检测；公开密钥方案虽能保护隐私，但在短文本中难以嵌入足够的密码学信息，导致实用性不足。此外，缺乏正式的安全保证使得检测结果可能被伪造或篡改，影响内容的可信度。这些问题限制了水印技术在实际内容审计中的应用，亟需一种兼具隐私保护、验证性和高效性的方案。
Innovation
VOW的核心创新在于引入基于VOPRF的检测协议，首次实现短文本场景下的隐私保护与可验证检测。具体包括：
- �� 将水印判定逻辑定义为VOPRF的点函数评估，避免复杂的集合成员测试，提升效率；
- �� 设计交互式协议，确保用户输入在检测过程中保持隐私，提供密码学证明保证检测结果的真实性；
- �� 结合优化算法，降低短文本检测的计算和通信成本，适应实际应用需求；
- �� 提出安全模型，形式化分析恶意提供者和用户的威胁，确保方案的安全性。
Methodology
- �� 设定阶段：提供者运行VOPRF的Setup算法生成密钥对，私钥用于水印嵌入，公钥用于验证。
- �� 水印插入：在文本生成过程中，提供者对每个候选词计算VOPRF输出，根据输出判定是否为绿色词，调整对应logits，实现水印嵌入；
- �� 检测阶段：用户与提供者进行交互，用户对文本中的每个词构造盲输入，提供者评估并返回带证明的输出，用户验证后统计绿色词比例，进行统计检验。
- �� 统计检验：采用单边二项检验，判断绿色词比例是否显著高于阈值，从而判定文本是否含水印。
Experiments
采用OpenAI GPT-4和自研的paraphrasing模型进行鲁棒性测试，数据集包括新闻摘要、代码片段和对话文本。比较VOW与传统Green-Red方案的检测准确率和抗攻击能力。指标包括检测成功率、误报率、时间成本和通信开销。通过不同paraphrasing策略验证鲁棒性，分析在不同参数下的性能表现。结果显示，VOW在短文本中检测成功率超过85%，抗paraphrasing攻击时保持80%以上的检测率，验证其实用性。
Results
VOW在短文本场景下检测准确率超过85%，在对抗 paraphrasing 攻击时仍保持80%以上的成功率，显著优于传统方案的50-60%。检测平均耗时约200毫秒，通信成本降低30%。安全性分析表明，恶意提供者无法伪造检测结果，用户隐私得到充分保护。这些结果验证了VOW在实际应用中的有效性和安全性。
Applications
VOW适用于AI内容审计、版权追溯、模型责任追究等场景。用户可以在不泄露敏感信息的情况下验证内容来源，模型提供者也能确保检测的可信性。未来，该方案还可扩展到多模态内容和大规模部署，为AI行业建立可信追溯体系，推动行业标准制定。
Limitations & Outlook
尽管VOW在短文本检测中表现优异，但在极端 paraphrasing 攻击下鲁棒性仍有待提升，未来需结合语义保持技术增强抗干扰能力。此外，协议在超大词表或高频调用场景中仍存在性能瓶颈，需优化算法或硬件支持。当前安全模型假设经典密码学基础，未来应考虑量子攻击等新威胁。
Plain Language Accessible to non-experts
想象你在一个工厂里做巧克力，每个巧克力都可以藏着一个秘密标记。工厂用一种特殊的密码，把这个标记藏在巧克力里，只有知道密码的人才能确认它是否是真的。每次生产时，工厂会用密码决定哪些巧克力带有标记，消费者想确认时，他们可以用另一套密码和工厂合作，验证巧克力的真伪，而不用告诉工厂他们买了什么。这样，工厂保证了秘密标记不会被别人伪造，也保护了消费者的隐私。这个方法就像VOW一样，用密码学的工具让检测既安全又可信，特别适合短文本，比如一句话或一段代码。它确保内容的来源可以被验证，同时不会泄露用户的敏感信息。
ELI14 Explained like you're 14
想象你和朋友在玩一个秘密游戏，你们在每个巧克力上藏了一个特殊的符号，只有你们知道这个符号的秘密密码。当你想确认某个巧克力是不是你们的，你们会用一种特别的密码方式，偷偷地验证，而不用告诉别人你们的秘密。这就像VOW用的密码技术一样，它让你可以验证内容是不是你们的，但又不会把秘密告诉别人。这样，别人就不能假冒你们的巧克力，也不能偷看你的秘密。这个方法特别适合短短一句话或者一段代码，因为它既安全又快。未来，这种技术还能用在很多地方，比如保护版权、验证内容来源，让网络上的信息更可信。
Glossary
VOPRF (Verifiable Oblivious Pseudorandom Function)
A cryptographic primitive allowing one party to evaluate a pseudorandom function on an input without revealing the input, while enabling proof verification of correctness.
Used in VOW to achieve privacy-preserving and verifiable watermark detection.
Green-Red scheme
A watermarking method that partitions vocabulary into green and red lists based on a secret key, embedding statistical signals into generated text.
Basis for VOW's core watermarking logic, adapted with cryptographic primitives.
Two-party computation (2PC)
A cryptographic protocol enabling two parties to jointly compute a function over their inputs without revealing them.
VOW employs 2PC to ensure privacy and verifiability in detection.
Watermark robustness
The ability of a watermark to withstand modifications like paraphrasing while remaining detectable.
Evaluated experimentally in the paper.
Binomial test
A statistical hypothesis test used to determine if the proportion of green tokens exceeds a threshold, indicating watermark presence.
Applied during detection to decide if text is watermarked.
Open Questions Unanswered questions from this research
- 1 How to further improve VOPRF efficiency for extremely large vocabularies, especially under resource constraints.
- 2 Exploring deep learning techniques to enhance watermark robustness against semantic paraphrasing attacks.
Abstract
Large Language Model (LLM) watermarking is crucial for establishing the provenance of machine-generated text, but most existing methods rely on a centralized trust model. This model forces users to reveal potentially sensitive text to a provider for detection and offers no way to verify the integrity of the result. While asymmetric schemes have been proposed to address these issues, they are either impractical for short texts or lack formal guarantees linking watermark insertion and detection. We propose VOW, a new protocol that achieves both privacy-preserving and cryptographically verifiable watermark detection with high efficiency. Our approach formulates detection as a secure two-party computation problem, instantiating the watermark's core logic with a Verifiable Oblivious Pseudorandom Function (VOPRF). This allows the user and provider to perform detection without the user's text being revealed, while the provider's result is verifiable. Our comprehensive evaluation shows that VOW is practical for short texts and provides a crucial reassessment of watermark robustness against modern paraphrasing attacks.