In plain words: Text watermarks leave a hidden signal by making a secret set of words slightly more likely as the model writes. Tested across question answering, classification, and translation, they cut classification accuracy 10 to 20% on average, and hurt every task type.
Abstract · Downstream Trade-offs of a Family of Text Watermarks
Watermarking involves implanting an imperceptible signal into generated text that can later be detected via statistical tests. A prominent family of watermarking strategies for LLMs embeds this signal by upsampling a (pseudorandomly-chosen) subset of tokens at every generation step. However, such signals alter the model's output distribution and can have unintended effects on its downstream performance. In this work, we evaluate the performance of LLMs watermarked using three different strategies over a diverse suite of tasks including those cast as k-class classification (CLS), multiple choice question answering (MCQ), short-form generation (e.g., open-ended question answering) and long-form generation (e.g., translation) tasks. We find that watermarks (under realistic hyperparameters) can cause significant drops in LLMs' effective utility across all tasks. We observe drops of 10 to 20% in CLS tasks in the average case, which shoot up to 100% in the worst case. We notice degradations of about 7% in MCQ tasks, 10-15% in short-form generation, and 5-15% in long-form generation tasks. Our findings highlight the trade-offs that users should be cognizant of when using watermarked models.
Anirudh Ajith, Sameer Singh, Danish Pruthi
arXiv:2311.09816 · cs.CL, cs.AI, cs.CR, cs.LG · submitted Nov 16, 2023 · updated Oct 20, 2024
abstract · pdf · html · Published at EMNLP Findings 2024
Here is another fresh paper on the same topic from Chinese researchers:
https://arxiv.org/abs/2311.09535
While they discuss some attacks, they too do not consider altering the output from a LLM, possibly through f(g(h(...))).