^*^*footnotetext: Equal Contribution. Correspondence at {tomsander,pfz}@meta.com

Tom Sander^∗
Meta FAIR & École polytechnique
&Pierre Fernandez^∗
Meta FAIR & Inria Rennes Alain Durmus
École polytechnique &Matthijs Douze
Meta FAIR &Teddy Furon
Inria Rennes

Abstract

We investigate the radioactivity of text generated by large language models (LLM), i.e., whether it is possible to detect that such synthetic input was used to train a subsequent LLM. Current methods like membership inference or active IP protection either work only in settings where the suspected text is known or do not provide reliable statistical guarantees. We discover that, on the contrary, it is possible to reliably determine if a language model was trained on synthetic data if that data is output by a watermarked LLM. Our new methods, specialized for radioactivity, detects with a provable confidence weak residuals of the watermark signal in the fine-tuned LLM. We link the radioactivity contamination level to the following properties: the watermark robustness, its proportion in the training set, and the fine-tuning process. For instance, if the suspect model is open-weight, we demonstrate that training on watermarked instructions can be detected with high confidence (-value ) even when as little as of training text is watermarked. Radioactivity detection code is available at https://github.com/facebookresearch/radioactive-watermark

Figure 1: Bob fine-tunes his LLM on data with a fraction coming from Alice’s LLM. This leaves traces in Bob’s model that Alice can detect reliably, provided that her text was watermarked. Thus, a side effect of Alice’s watermark, intended for machine-generated text detection, is to reveal what data Bob’s model was fine-tuned on.

1 Introduction

Large Language Models (LLMs) are often instruction fine-tuned to align them with human prompts and improve their performance and generalization (Ouyang et al., 2022; Wei et al., 2022; Chung et al., 2022). Fine-tuning requires expert knowledge to balance diversity and quality in the instruction dataset and a costly collection of manual annotations, especially for alignment (OpenAI, 2023; Touvron et al., 2023b; Gemini, 2023). To address the cost and the difficulties of fine-tuning, practitioners often train on synthetic data generated by a model that has already been instructed, such as Bard, ChatGPT, or Claude. For example, works by Wang et al. (2022); Honovich et al. (2022); Peng et al. (2023a) created instruction data for many of the most recent LLMs (Taori et al., 2023; Xu et al., 2023; Gunasekar et al., 2023; Mukherjee et al., 2023). This may also be unintentional when, for example, Turkers use ChatGPT to perform their tasks (Veselovsky et al., 2023). Such imitation raises questions about whether the fine-tuned model is a derivative work of the original model (Wallace et al., 2020). In this context, it is crucial to understand how to detect when LLM outputs are used as training data.

Meanwhile, recent AI regulations enforce the transparency of generative models. This is increasingly important in cases where the generated content may be used for malicious purposes (Weidinger et al., 2022; Crothers et al., 2022). One approach is watermarking. It embeds a secret trace in the synthetic content that can be detected to identify the generating model. In the context of LLMs, recent techniques make detection efficient with minimal degradation of the generated text quality by altering the sampling of next tokens (Aaronson and Kirchner, 2023; Kirchenbauer et al., 2023a, b).

Based on these two observations, this study addresses the following question:

What occurs when watermarked text is employed as fine-tuning data?

We explore the potential “radioactivity” – a term coined by Sablayrolles et al. (2020) – of LLM watermarking, which refers to the capacity of watermarked training data to contaminate a model.

We examine a model that has been fine-tuned on a corpus that may contain watermarked text (see Fig. 1). The baseline method for detecting radioactivity executes the original watermark detection on the outputs generated by this model. However, this approach proves ineffective because the residual of the watermark is a weak signal hardly detectable in plain output text. In this work, we are able to demonstrate that LLM watermarking is indeed radioactive thanks to our specific protocol designed for revealing weak contamination traces. Our contributions include:

•
We design radioactivity detection methods for four scenarios based on model (open / closed) and training data (supervised / unsupervised) access. Notably, our open-model detection (Fig. 3) improves the performance by orders of magnitudes.
•
We show how to obtain reliable -values for watermark detection when scoring millions of tokens.
•
We prove that watermarked text is radioactive in a real-world setting where an LLM is fine-tuned on slightly watermarked instruction data. For instance, in the open-model scenario, our tests detect radioactivity with a of when only 5% of fine-tuning data is watermarked (Fig. 6).

2 Background

2.1 Related work

Watermarking for LLMs.

A recent branch of watermarking methods for decoder-only LLMs modifies either the probability distribution (Kirchenbauer et al., 2023a) or the sampling method of the next token (Aaronson and Kirchner, 2023; Kuditipudi et al., 2023). Theoretical studies indicate that detectability depends on the entropy of generated text (Christ et al., 2023; Huang et al., 2023). Subsequent research suggests watermarking entropic passages, particularly in code (Lee et al., 2023), while other works focus on “semantic” watermarks that depend on an entire past text’s semantic representation (Liu et al., 2023; Liu and Bu, 2024; Fu et al., 2024b).

Gu et al. (2023) distill the methods used in this study within the model weights, allowing LLMs to generate watermarked logits natively, which is key for open-source models. In contrast, we focus on unintentional contamination: Alice and Bob in Fig. 1 are not collaborating, and Bob consumes only a small proportion of watermarked data.

Membership inference attacks

(MIAs) aim to determine whether an arbitrary sample is included in a model’s training data, with varying granularity on the adversary’s knowledge (Nasr et al., 2019). Most of the time, the detection either build shadow models and observe a difference in their behavior (Shokri et al., 2017a, b; Hisamoto et al., 2020; Mahloujifar et al., 2021) or directly observe the loss of the model (Yeom et al., 2018; Sablayrolles et al., 2019; Watson et al., 2021; Carlini et al., 2022). In the context of generative models, MIAs are intertwined with dataset contamination where one detects that an entire dataset is part of the training data (Shi et al., 2023; Golchin and Surdeanu, 2023). MIAs can violate the confidentiality of sensitive training or reveal training on “forbidden” data, like copyrighted material or evaluation data (which undermines benchmark results).

MIA may be used for radioactivity detection, but with a strong limitation. Since it focuses on specific pieces of text, Alice in Fig. 1 has to record all the outputs of her LLM.

IP Protection.

Watermarking can be used for intellectual property protection. For instance, He et al. (2022b, a); Li et al. (2023) use lexical properties like synonyms whereas Peng et al. (2023b) rely on backdoors. Zhao et al. (2023) develop a watermark dissuading model theft via distillation. Yet its accuracy is empirical, it does not provide -values that align with empirical false positive rates.

Radioactivity.

Sablayrolles et al. (2020) introduce the concept of radioactivity: images are modified to leave a detectable trace in any classifier trained on them. Our work studies the radioactivity of decoding-based LLM watermarks, which are primarily used to detect AI-generated text with proven accuracy. We demonstrate that this form of radioactivity is reliably detectable across diverse settings. Appendix E.2 details why existing IP protections or MIAs do not offer similar capabilities.

2.2 Technical background for LLM watermarking

This paper focuses on watermarking schemes that modify the LLM decoding by hashing a watermark window. In experiments we use (Aaronson and Kirchner, 2023; Kirchenbauer et al., 2023a) due to their omnipresence in the literature, their performance, and their practicality. We briefly overview them and refer the reader to Appendix C for details (on the watermark detection tests especially).

We consider a decoder-only LLM that takes as input a context (a sequence of tokens , being the vocabulary of the model) and outputs a vector of logits . Vector is transformed into , the probability distribution of the next token. The text is generated by sampling the next token from this distribution with some procedure (top-k sampling (Fan et al., 2018; Radford et al., 2019), nucleus-sampling (Holtzman et al., 2019), etc.), then appending it to the context, and repeating the process.

The watermark embedding alters the logit vector or the sampling procedure depending on a secret key. Usually, the output of a secret-key cryptographic function hashes previous tokens (the watermark window) and the secret-key . It serves as a seed for a random number generator, that influences the choice of the next token . For instance, Kirchenbauer et al. (2023b) create a pseudo-random “greenlist” of tokens with proportion of the entire vocabulary, whose logits are incremented by a quantity , increasing their sampling probability.

The watermark detection tokenizes a text, replays the seed generation and scores each token. The score function on a current token may therefore be summed up as that also takes as input the watermark window , and depends on the hashing’s secret-key :

(1)

A statistical test is performed on the cumulative score – which follows a known distribution in the absence of watermark, see App. C – where is a list of tuples and:

(2)

3 Problem Formulation

Alice owns a language model , fine-tuned for specific tasks such as chatting, problem solving, or code generation, which is available through an API (Figure 1). Bob owns another language model . Alice suspects that Bob fine-tuned on some outputs from . We denote by the dataset used to fine-tune , among which is made of outputs from , in proportion .

Access to Bob’s data.

We consider two settings for Alice’s knowledge about Bob’s training data:

•
supervised: Bob queries and Alice retains all the content that generated for Bob. Thus, Alice knows that . We define the degree of supervision ,
•
unsupervised: Bob does not use any identifiable account or is hiding behind others such that and . This is the most realistic scenario.

Thus, is the proportion of Bob’s fine-tuning data which originates from Alice’s model while quantifies Alice’s knowledge regarding the dataset that Bob may have utilized (see Fig. 2).

Access to Bob’s model.

We consider two scenarios:

•
Alice has an open-model access to . She can forward any inputs through and observe the output logits. This is the case if Bob open-sources , or if Alice sought it via legitimate channels.
•
Alice has a closed-model access. She can only query through an API without logits access: Alice only observes the generated texts. This would be the case for most chatbots.

We then introduce two definitions of radioactivity:

Definition 1 (Text Radioactivity).

Dataset is -radioactive for a statistical test if “ was not trained on ” and is able to reject at a significance level (-value) smaller than .

Definition 2 (Model Radioactivity).

Model is -radioactive for a statistical test if “ was not trained on outputs of ” and is able to reject at a significance level smaller than .

Thus, quantifies the radioactivity of a dataset or model. A low , e.g. , indicates strong radioactivity: the probability of observing a result as extreme as the one observed, assuming that Bob’s model was not trained on Alice’s outputs, is 1 out of one million. Conversely, means that the observed result is equally likely under both the null and alternative (radioactive) hypotheses.

	With WM	Without WM (MIA)	IPP
	Open	Closed	Open	Closed	Open	Closed
Supervised	✓	✓	✓	✗	✓
Unsupervised	✓	✓	✗	✗	✗	✗

Table 1: Availability of radioactivity detection under the different settings. Open / closed-model refers to the availability of Bob’s model, and supervised / unsupervised to Alice’s knowledge of his data. Detection with watermarks is described in Sec. 4, and a baseline without WM relying on MIA in App. E.1. Intellectual Property Protection (IPP) refers to Zhao et al. (2023); see App. E.2.

Figure 2: Detection performance mainly depends on and , where is the fine-tuning dataset used by Bob, are the outputs from Alice’s model, and the intersection of both.

4 Radioactivity Detection

We build radioactivity detectors for all settings as shown in Tab. 1. The outputs of are watermarked with a method with Alice’s secret key as described in Sec. 2.2. Note that, unlike watermark detection which takes text as input, the input for radioactivity detection is a model.

4.1 Theoretical validity of statistical tests for radioactivity detection

In the following, we construct a radioactivity test on based on the detection score of Alice’s watermarking method. We focus on Kirchenbauer et al. (2023a) with the notations of Sec. 2.2 for simplicity. Each in is a -tuple of tokens and is generated by from the preceding tokens , where is an optional context, e.g. prompt. Note that the contexts are crafted by Alice to better detect radioactivity in . As we see in Sec. 5.3, this can imply that they are watermarked themselves. In this scenario, an accurate statistical test for detecting radioactivity can be performed through de-duplication. Let be “ follows a binomial distribution ”. Then:

Proposition 1.

“B was not trained on Alice’s watermarked data” if tokens are de-duplicated: (1) are pairwise distinct and (2) for each , is not in the context .

The proof and a formal statement of this result are provided in App. D.2.1.

With this inclusion, we can thus use a statistical test for hypothesis to test against radioactivity. Specifically, assuming conditions (1) and (2) are met, the -value can be accurately computed using the regularized incomplete beta function detailed in App. C. The necessity of condition (1) to simulate i.i.d. scores is also used in classical watermark detection (Fernandez et al., 2023; Kirchenbauer et al., 2023a), but is more pronounced in our scenario, given the larger volume of tokens required to observe radioactivity. (2) however is not necessary in classical watermark detection, as the prompt used to generate text is assumed not to be watermarked. In our case, we show in Sec. 5 and App. D.2 that both are critical in order to get reliable -values.

4.2 Radioactivity detection in practice

Naive approach.

Text radioactivity can be detected by running on any text generated by . However, this detector is weak because radioactivity can only be observed on an if it was part of ’s watermarked outputs in ’s training data. This is because there is no correlation between the green lists of different watermark windows, since each partition is only a function of the watermark window through a hash function.

Overview.

We use the detection test detailed in Sec 4.1 on generated through carefully crafted prompts, as our goal is to reduce noise by focusing on contexts likely to lead to radioactivity signals. To this end, we recreate contexts similar to the ones that generated the watermarked text by Alice. We ensure the accuracy of statistical tests through de-duplication of scored tokens.

Figure 3: Radioactivity detection with closed or open model access (for simplicity, only (Kirchenbauer et al., 2023a) is illustrated). (Left) New texts are generated from using prompts from and these texts are scored. The filter is used to focus the score computation on likely contaminated -grams. (Right) Text generated by are directly forwarded through , and the next-token predictions are scored using tokens from the input as the watermark window. In both cases, the tape ensures reliable -values by de-duplicating scored tokens.

Radioactivity detection in .

To amplify the signals of radioactivity, we employ two strategies. (1) In the supervised setting, we use watermarked text from . In the unsupervised setting, we use other watermarked text generated by that aligns with the suspected training distribution of (e.g., English dialogues), but that was not used by . (2) We score up to millions of tokens, orders of magnitudes more than usual. The scoring depends on the access to :

•
closed-model: we use the prompts to generate new texts from , and score these texts.
•
open-model, “reading mode”: instead of generating completions with , we directly forward the text generated by through , as depicted in Fig. 3. We then score next-token predictions with by using tokens from the input as watermark windows. Intuitively, for each green list token present in ’s watermarked text, the context that led to its generation is reproduced. This allows Alice to focus her analysis on how responds to these specific contexts, which are more likely to lead to radioactivity signals than more generic ones.

Filter on scored -grams.

To further improve detection in the closed-model setting where the reading mode is not possible, we only score -tuples output by for which the watermark window is often in ’s watermarked outputs. We thus introduce a filter , a set that contains these watermark windows. In the supervised setting (), is made of the -grams present in (refer to Fig. 2). In the unsupervised setting, we focus on ‘likely’ contaminated -grams, e.g., -grams appearing in (new) watermarked text generated by .

Token scoring and de-duplication.

We score a token only if the same ()-tuple has not been previously encountered. Moreover, in the closed-model setting, we only score watermark windows (-tuple) that are not part of the (watermarked) prompt. In the open-model setting, tokens with watermarked windows previously present in the attention span are not scored. This is achieved by maintaining a tape memory of all such -grams combinations during detection. These adjustments ensure reliable -values even when many tokens are analyzed. This is empirically validated in Sec. 5.4, and additional details on the correctness of our tests are provided in App. D.

5 Radioactivity in Instruction Datasets

This section considers a realistic scenario where a pre-trained LLM is instruction fine-tuned on instruction/answer pairs generated by . It shows that watermarked instructions are radioactive and compares the confidence of our different detection methods.

5.1 Experimental setup of the instruction tuning

Instruction data generation.

We follow the Self-Instruct protocol (Wang et al., 2022) with =Llama-2-chat-7B (Touvron et al., 2023b) (results hold for bigger teachers, see App. F.3). We prompt the model with an instruction followed by three examples of instruction/answer pairs and ask it to generate the next instruction/answer pairs. The sampling from the LLM logits is done with or without the watermarking method of Kirchenbauer et al. (2023a), at logit bias , proportion of greenlist tokens , and . In both cases, we use nucleus sampling (Holtzman et al., 2019) with and . We post-process the generated data to remove unfinished answers and near-duplicate instructions. This yields a dataset of 100k instruction/answer pairs (14M tokens). Appendix F shows examples of these instructions and the watermark detection rates.

Finally, we create six mixed datasets with % of watermarked data (with ), filling the rest with non-watermarked instructions. Thus, the total number of instructions is fixed at around 14M tokens, but the proportion of watermarked ones (which represents ’s outputs) varies.

Fine-tuning.

We train on these six datasets, closely following the approach of Alpaca (Taori et al., 2023): we use AdamW (Loshchilov and Hutter, 2017a) for 3000 steps, with a batch size of 8, a learning rate of and a context size of 2048 tokens (which results in 3 training epochs). The learning rate follows a cosine annealing schedule (Loshchilov and Hutter, 2017b) with 100 warmup steps. We set =Llama-1-7B (Touvron et al., 2023a), a model trained on different datasets than =Llama-2, to avoid biases that could arise if the same base model were also used for fine-tuning.

5.2 Quality inspection of the instruction tuning

Table 2: Evaluation of Llama-7B fine-tuned with varying proportions of watermarked instruction data.

	NQ	TQA	GSM8k	H.Eval	Avg.	MMLU
Fine-tuned with % of watermarked data:




Base

Table 3: Detection confidence with varying supervision at of ’s training data from , in the open-model setting using the reading mode for detection (see Fig. 3).

Supervision degree
	1.8
	0.9
	2.6

Figure 4: Answers generated from Bob’s model (Llama-1), fine-tuned on instruction data generated by Alice’s model (Llama-2-chat) with different proportions of watermarked data. The quality of the instruction-tuning is not affected by the watermarking of the data (examples of training instruction/answer pairs are in Fig. 15).

Alice’s watermarking hyperparameters aim at 1) generating high-quality instructions and 2) ensuring that the watermark can be detected even in small text segments: the watermark window size is , sufficiently wide to eliminate biases yet narrow enough to make the watermark robust to edits; yields high-quality text while ensuring that the watermark can be detected with a -value of on approximately 100 tokens (full results in App. F.2).

We inspect the outputs of the fine-tuned model both qualitatively (see examples in Fig. 4 and App. F) and quantitatively in Tab. 3. We report 0-shot scores for an evaluation setup close to that of Llama: exact match score for Natural Questions (Kwiatkowski et al., 2019) and TriviaQA (Joshi et al., 2017); 0-shot exact match score without majority voting for GSM8k (Cobbe et al., 2021); pass@1 for HumanEval (Chen et al., 2021); and accuracy on MMLU (Hendrycks et al., 2020). As expected, instruction-tuning does not affect most benchmarks while enhancing it for MMLU, as in (Dettmers et al., 2023). Thus, watermarking does not significantly impact the fine-tuned model performance.

Figure 5: Radioactivity detection results. Average of over 10 runs ( is better). Bars indicate standard deviations. The detection methods are detailed in Sec. 4. In the supervised closed-model setting, our tests detect radioactivity () when only of training data is watermarked. In the absence of watermarked data, all tests output random -values.

Figure 6: Influence of the filter on scored tokens. as a function of the number of generated tokens in the supervised closed-model setting with . We perform the watermark detection test on text generated by with prompts from . When filtering, we only score -grams that were part of .

5.3 Experimental setup of the detection

In the open-model setting, we use a set of watermarked instructions generated by Alice’s model to score k tokens. For the supervised setting (), we directly use all the watermarked texts among the 100k instructions used to train ; for the unsupervised setting (), we use watermarked instructions unused by . We use the “reading mode” for detection (see Sec. 4).

In the closed-model setting, is only accessible via an API. We prompt with instructions generated by , concatenate all the answers, and score k tokens, after filtering and de-duplicating the -grams of M generated tokens. This represents around queries if we assume an answer is tokens. We score a token only if its previous -gram is part of filter . In the supervised setting (), we collect the watermarked prompts/answers from , part of which were used for fine-tuning, and define as the set of all the -grams present in it. In the unsupervised setting, we generate k new watermarked instructions with and save all -grams into . In both cases, we run the detection times on different chunks of text and report averaged results.

5.4 Detection results

Proportion of watermarked data and access to Bob’s model and data.

Figure 6 first presents the -values of our tests for different proportions , under the 4 possible scenarios, and shows that the detection confidence increases with the proportion of watermarked data, and with Alice’s knowledge.

The supervised setting () is straightforward: radioactivity is detected with a -value smaller than (resp. ) in the open-model (resp. closed-model) setting, even if only of Bob’s fine-tuning data originated from . Indeed, with open-model access, we only score 1) -grams that can actually be contaminated and 2) within a context that matches the one seen during fine-tuning. In the closed-model access, prompting with its training questions enhances radioactivity detection, as its answers are likely to reproduce the watermarked responses from used during training.

In the unsupervised setting (), our open-model radioactivity detection test still yields when no more than of the instructions used to fine-tune originate from Alice’s model. The detection is done on a corpus of texts that does not contain samples seen by Bob at training time. However, it contains watermark windows that likely overlap with Bob’s training data, on which radioactivity may be detected. In the closed-model setting, the detection is less powerful: it requires a higher proportion of watermarked data to be detected with a -value smaller than .

Influence of the degree of supervision.

To study the intermediate regime of weak supervision, we fix in the open-model detection. We vary the supervision degree by mixing the watermarked data used for fine-tuning with new watermarked data generated by in a ratio to simulate . We then run the radioactivity detection test with the reading mode on this corpus. Table 3 shows that the detection confidence increases with the supervision degree (from to when goes from to ). Even for very weak supervision, the detection is still effective, with a -value smaller than when . This is in stark contrast with MIA-based methods for which supervision is necessary (we detail this in Fig. 10 of App. E.1).

Influence of the filtering in the closed-model setting.

Figure 6 compares detection with and without the filter when of fine-tuning data is watermarked in the supervised closed-model setting (with ). We plot the against the number of generated tokens. As expected, the detection confidence increases with the number of tokens. Moreover, filtering consistently brings improvements: after scoring tokens, the equals with filter and without. Filtering appears particularly important to increase the detection confidence on the worst-case scenarios (see the largest observed over the 10 runs in Fig. 12 of App. F).

Influence of the de-duplication on the correctness of radioactivity tests.

For a statistical test to be valid, the -value should be uniformly distributed between 0 and 1 under the null hypothesis (mean , standard deviation of ). Accurate theoretical -values are particularly important in the common case where obtaining samples of fine-tuned is expensive. This cost limits the sample size, reducing the power of empirical tests and compromising the confidence in their results.

We validate our tests and highlight the importance of de-duplication by observing the empirical -value distribution after scoring 1M tokens when is not trained on watermarked data (). We first run 10 detection tests when scoring distinct watermarked window + current token combinations, as suggested by (Kirchenbauer et al., 2023a; Fernandez et al., 2023). This approach is insufficient on its own, as shown in Tab. 5 in the “without de-duplication” column. For instance, in the closed-model setting, the average is inferior to even if the model does not output watermarked texts. This is a strong false alarm, i.e., incorrectly rejecting the null hypothesis. The additional de-duplication rules (Sec. 4) resolve this issue. We observe in the “with de-duplication” column that the empirical -values match the theoretical ones, indicating that the test results are valid and reliable. These statistics, computed across various secret keys and seeds, are detailed in App. D.1. App. D.2 gives additional details, supported by additionnal experiments, on the importance of de-duplication.

5.5 Intermediate summary & discussion

Our watermark-based radioactivity detection methods can identify -radioactivity in model across various setups. Even in the most realistic scenario – unsupervised access to Bob’s data – our method holds true with only closed access to , given that at least of the data is watermarked. Open-model access further enhances the test’s statistical significance, detecting radioactivity with a -value smaller than when of the fine-tuning data is watermarked (Fig. 6). Note that we deliberately score different numbers of tokens for the open and closed-model settings. It shows that the open-model is more efficient since it requires fewer tokens to achieve lower -values (see Fig. 6) . Furthermore, since -values plateau beyond a certain threshold (see Fig. 6), additional token scoring in the open-model setting does not significantly enhance detection.

Other approaches. The applicability of other approaches is summarized in Tab. 1: “✗” means that no method in the literature currently tackles this problem with LLMs, and “” means that methods that address the problem have strong technical issues (the statistical guarantees do not hold). Indeed, we show in App. E.1 that other passive methods like Membership Inference Attacks (MIAs) are effective only in the supervised setting, where Alice has precise knowledge of the data used to train Bob’s model and open access to it. In that scenario, she can demonstrate -radioactivity, providing strong evidence that Bob has trained on her model. App. E.2 demonstrates that even state-of-the-art active protection methods (Zhao et al., 2023) fall short in the unsupervised setting.

Besides, our tests provide reliable -values thanks to meticulous de-duplication. When is not trained on watermarked data, the -values are not overly low (Fig. 6, Tab. 5, App. D). App. E.2 shows that this is not the case for recent synonym replacement-based watermarks (He et al., 2022a, b).

Table 4: Average -values under ( not trained on watermarked data: should be 0.5). In the open-model setting (resp. closed), we exclude a token if the same watermark window is already present in the attention span (resp. in the watermarked prompt). Without de-duplication, -values are overly low: the test does not work.

	De-duplication
Access to Model	With	Without
Open	0.460.27	0.0530.12
Closed	0.420.30

Table 5: Influence of watermarking method and on radioactivity. Average -values. “Orig” denotes watermark detection of texts used for training (100 tokens); “Rad” denotes radioactivity detection in closed-model setting (=k, =). Both KGW (Kirchenbauer et al., 2023b) and AK (Aaronson and Kirchner, 2023) behave the same way and lower increases radioactivity.

Window Size	1	2	4
KGW	Orig	-8.64.4	-6.43.9	-6.74.0
Rad	-43.77.4	-10.23.0	-1.40.6
AK	Orig	-7.74.5	-7.65.1	-7.15.1
Rad	-47.24.5	-18.42.8	-2.83.2

6 Investigating Radioactivity

This section further studies what influences radioactivity from three angles: fine-tuning, watermarking algorithm, and data distribution. We also explore how Bob can try to remove radioactivity traces. Other scenarios such as multi-bit watermarking (Yoo et al., 2024) and other influencing factors, such as the size of model or mixes of different fine-tuning data, are studied in App. F.

Table 6: Influence of the model fine-tuning on the radioactivity. We report the for k scored observations (lower means more radioactive). Gray indicates values used in Sec. 5.


-32.4	-49.6	-58.0

(a)

1	2	3	4
-20.8	-29.2	-33.2	-34.8

(b)

Full	Q-LoRA
-32.4	-11.0

(c)

7B	13B
-32.4	-33.2

(d)

6.1 Fine-tuning

We first study the influence of fine-tuning on the same setup as Sec. 5, with regards to: (a) the learning rate, (b) the fine-tuning algorithm, (c) the number of epochs, (d) the model size. We fine-tune with the same dataset of watermarked instructions and the same parameters. We detect radioactivity in the open-model / unsupervised setting. This is done on k next-predictions, and where the texts that are fed to are watermarked instructions generated with . Table 6 reports the results. The more the model fits the data, the easier its radioactivity is to detect. For instance, multiplying the learning rate by almost doubles the average of the test.

6.2 Watermarking method & data distribution

To introduce more variety to the data under study, we now prompt =Llama-2-7B with the beginnings of Wikipedia articles in English and generate the next tokens with or without watermarking. We then fine-tune =Llama-1-7B on the natural prompts followed by the generated answers. The fine-tuning is done in 1000 steps, using batches tokens (similarly to Sec. 5). This section fine-tunes on English watermarked texts. We explore two aspects of the radioactivity.

Watermark window size.

Table 5 highlights that the confidence of the detection decreases with when fixing the -value of the watermark detection of the training texts. There are two explanations. First, for lower , the chances that a ()-tuple repeats in the training data are higher, which increases its memorization. Second, the number of watermark windows is and therefore increases with , while the number of watermarked tokens is fixed. Thus, at detection time, the proportion of radioactive tuples decreases with , diminishing the test’s power. This experiment also demonstrates that the methods of Aaronson and Kirchner (2023) and Kirchenbauer et al. (2023b) behave similarly.

Table 7: Influence of the target text distribution on detection. is prompted with beginnings of Wikipedia articles in the corresponding language, and detection is done on generated next tokens. For each language, we score k -grams using the closed-model setting described in Sec. 4.

Language	English	French	Spanish	German	Catalan
	-50	-7.8	-5.7	-4.0	-2.1

Data distribution.

We consider an unsupervised setting where Alice has no prior knowledge about , the data generated with used to fine-tune . As an example, Alice does not know the language of , which could be Italian, French, Chinese, etc. We run the detection on text generated by , with prompts from Wikipedia in different languages. The confidence of the test on another language – that might share very few -grams with – can be low, as shown in Tab. 7.

Alice may, however, combine the -values of each test with Fisher’s method. This discriminates against : “none of the datasets are radioactive”, under which the statement “Bob did not use any outputs of ” falls. Therefore, the test aligns with our definition of model radioactivity as per definition 2. From Tab. 7, Fisher’s method gives a combined -value of . Thus, even if Alice is unaware of the specific data distribution generated by that Bob may have used to train (e.g., problem-solving scenarios), she may still detect radioactivity by combining the significance levels.

6.3 Possible defense: “Purification”

Table 8: Sequential fine-tuning to remove watermark traces. The first fine-tuning is done with the setup presented in Sec. 5, with = of watermarked data, and the second on OASST1. Detection is performed in the open/unsupervised setting.

^nd fine-tuning	Average
✗	-15
✓	-8

We investigate the impact of a second fine-tuning on human-generated data to remove the watermark traces. After having trained his model on a mix of watermarked and non-watermarked data as in Sec. 5, Bob fine-tunes his model a second time on text from OASST1 (Köpf et al., 2024), with the same fine-tuning setup.

Table 8 shows that the second-fine-tuning divides by the significance level of the statistical test, but does not remove all traces. Other attempts to remove radioactivity could be to rephrase the watermarked instructions or use differentially private training. The logic is overall the same as previously pointed out in the fine-tuning ablations: if the original watermark is weaker or if the fine-tuning overfits less, then radioactivity will be weaker too. Therefore, the radioactivity detection will be less powerful, but given a sufficient amount of data, Alice may still be able to detect it.

7 Conclusion

This study formalizes the concept of “radioactivity” in language models. It introduces methods to detect traces that LLM-generated texts leave when used as training data. We show that this task is difficult for non-watermarked texts in the most realistic scenarios. Yet, watermarked texts exhibit significant radioactivity, contaminating models during fine-tuning. This makes it possible to identify with high confidence if outputs from a watermarked model have been used to fine-tune another one (although it may not be used to detect the use of the other model itself).

Acknowledgments

We thank Hervé Jégou, Alexandre Sablayrolles, Pierre Stock, Chuan Guo and Saeed Mahloujifar for insightful comments and useful discussions. Teddy Furon’s work is supported by ANR / AID under Chaire SAIDA ANR-20-CHIA-0011.

References

Aaronson and Kirchner [2023] Scott Aaronson and Hendrik Kirchner. Watermarking GPT outputs, 2023. URL https://scottaaronson.blog/?m=202302.
Carlini et al. [2021] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models, 2021.
Carlini et al. [2022] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE, 2022.
Chen et al. [2021] Mark Chen et al. Evaluating large language models trained on code. arXiv, 2021.
Christ et al. [2023] Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. Cryptology ePrint Archive, 2023.
Chung et al. [2022] Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Eric Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. Scaling instruction-finetuned language models. arXiv preprint arXiv:2210.11416, 2022.
Cobbe et al. [2021] Karl Cobbe et al. Training verifiers to solve math word problems. arXiv, 2021.
Crothers et al. [2022] Evan Crothers, Nathalie Japkowicz, and Herna Viktor. Machine generated text: A comprehensive survey of threat models and detection methods. arXiv preprint arXiv:2210.07321, 2022.
Dettmers et al. [2023] Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. Qlora: Efficient finetuning of quantized llms. arXiv preprint arXiv:2305.14314, 2023.
Fan et al. [2018] Angela Fan, Mike Lewis, and Yann Dauphin. Hierarchical neural story generation. arXiv preprint arXiv:1805.04833, 2018.
Fernandez et al. [2023] Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. Three bricks to consolidate watermarks for large language models. 2023 IEEE International Workshop on Information Forensics and Security (WIFS), 2023.
Fu et al. [2024a] Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick. arXiv preprint arXiv:2402.12948, 2024a.
Fu et al. [2024b] Yu Fu, Deyi Xiong, and Yue Dong. Watermarking conditional text generation for ai detection: Unveiling challenges and a semantic-aware watermark remedy. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 18003–18011, 2024b.
Gemini [2023] Team Gemini. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023.
Golchin and Surdeanu [2023] Shahriar Golchin and Mihai Surdeanu. Time travel in llms: Tracing data contamination in large language models. arXiv preprint arXiv:2308.08493, 2023.
Gu et al. [2023] Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models. arXiv preprint arXiv:2312.04469, 2023.
Gunasekar et al. [2023] Suriya Gunasekar, Yi Zhang, Jyoti Aneja, Caio César Teodoro Mendes, Allie Del Giorno, Sivakanth Gopi, Mojan Javaheripi, Piero Kauffmann, Gustavo de Rosa, Olli Saarikivi, et al. Textbooks are all you need. arXiv preprint arXiv:2306.11644, 2023.
He et al. [2022a] Xuanli He, Qiongkai Xu, Lingjuan Lyu, Fangzhao Wu, and Chenguang Wang. Protecting intellectual property of language generation apis with lexical watermark. In AAAI, 2022a.
He et al. [2022b] Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. CATER: Intellectual property protection on text generation APIs via conditional watermarks. In NeurIPS, 2022b.
Hendrycks et al. [2020] Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300, 2020.
Hisamoto et al. [2020] Sorami Hisamoto, Matt Post, and Kevin Duh. Membership inference attacks on sequence-to-sequence models: Is my data in your machine translation system? Transactions of the Association for Computational Linguistics, 8:49–63, 2020.
Holtzman et al. [2019] Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. arXiv preprint arXiv:1904.09751, 2019.
Honovich et al. [2022] Or Honovich, Thomas Scialom, Omer Levy, and Timo Schick. Unnatural instructions: Tuning language models with (almost) no human labor. arXiv preprint arXiv:2212.09689, 2022.
Hu et al. [2023] Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669, 2023.
Huang et al. [2023] Baihe Huang, Banghua Zhu, Hanlin Zhu, Jason D. Lee, Jiantao Jiao, and Michael I. Jordan. Towards optimal statistical watermarking, 2023.
Joshi et al. [2017] Mandar Joshi, Eunsol Choi, Daniel S Weld, and Luke Zettlemoyer. Triviaqa: A large scale distantly supervised challenge dataset for reading comprehension. arXiv, 2017.
Kirchenbauer et al. [2023a] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. arXiv preprint arXiv:2301.10226, 2023a.
Kirchenbauer et al. [2023b] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models, 2023b.
Köpf et al. [2024] Andreas Köpf, Yannic Kilcher, Dimitri von Rütte, Sotiris Anagnostidis, Zhi Rui Tam, Keith Stevens, Abdullah Barhoum, Duc Nguyen, Oliver Stanley, Richárd Nagyfi, et al. Openassistant conversations-democratizing large language model alignment. Advances in Neural Information Processing Systems, 36, 2024.
Kuditipudi et al. [2023] Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593, 2023.
Kwiatkowski et al. [2019] Tom Kwiatkowski et al. Natural questions: a benchmark for question answering research. Trans. of the ACL, 7, 2019.
Lacoste et al. [2019] Alexandre Lacoste, Alexandra Luccioni, Victor Schmidt, and Thomas Dandres. Quantifying the carbon emissions of machine learning. arXiv preprint arXiv:1910.09700, 2019.
Lee et al. [2023] Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation. arXiv preprint arXiv:2305.15060, 2023.
Li et al. [2023] Zongjie Li, Chaozheng Wang, Shuai Wang, and Cuiyun Gao. Protecting intellectual property of large language model-based code generation apis via watermarks. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 2336–2350, 2023.
Liu et al. [2023] Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models. arXiv preprint arXiv:2310.06356, 2023.
Liu and Bu [2024] Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models. arXiv preprint arXiv:2401.13927, 2024.
Loshchilov and Hutter [2017a] Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017a.
Loshchilov and Hutter [2017b] Ilya Loshchilov and Frank Hutter. SGDR: Stochastic gradient descent with warm restarts. In International Conference on Learning Representations, 2017b.
Mahloujifar et al. [2021] Saeed Mahloujifar, Huseyin A Inan, Melissa Chase, Esha Ghosh, and Marcello Hasegawa. Membership inference on word embedding and beyond. arXiv preprint arXiv:2106.11384, 2021.
Massey [1951] Frank J Massey. The kolmogorov-smirnov test for goodness of fit. Journal of the American Statistical Association, 46(253):68–78, 1951.
Mukherjee et al. [2023] Subhabrata Mukherjee, Arindam Mitra, Ganesh Jawahar, Sahaj Agarwal, Hamid Palangi, and Ahmed Awadallah. Orca: Progressive learning from complex explanation traces of gpt-4. arXiv preprint arXiv:2306.02707, 2023.
Nasr et al. [2019] Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE, 2019.
OpenAI [2023] OpenAI. Gpt-4 technical report. arXiv, 2023.
Ouyang et al. [2022] Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 35:27730–27744, 2022.
Peng et al. [2023a] Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. Instruction tuning with gpt-4. arXiv preprint arXiv:2304.03277, 2023a.
Peng et al. [2023b] Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. arXiv preprint arXiv:2305.10036, 2023b.
Piet et al. [2023] Julien Piet, Chawin Sitawarin, Vivian Fang, Norman Mu, and David Wagner. Mark my words: Analyzing and evaluating language model watermarks. arXiv preprint arXiv:2312.00273, 2023.
Radford et al. [2019] Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9, 2019.
Roelofs [2017] Greg Roelofs. zlib: A massively spiffy yet delicately unobtrusive compression library. http://www. zlib. net/, 2017.
Sablayrolles et al. [2018] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. D’eja vu: an empirical evaluation of the memorization properties of convnets. arXiv preprint arXiv:1809.06396, 2018.
Sablayrolles et al. [2019] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White-box vs black-box: Bayes optimal strategies for membership inference. In International Conference on Machine Learning, pages 5558–5567. PMLR, 2019.
Sablayrolles et al. [2020] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. Radioactive data: tracing through training. In International Conference on Machine Learning, pages 8326–8335. PMLR, 2020.
Shi et al. [2023] Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. arXiv preprint arXiv:2310.16789, 2023.
Shokri et al. [2017a] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models, 2017a.
Shokri et al. [2017b] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017b.
Taori et al. [2023] Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Stanford Alpaca: An instruction-following LLaMA model, 2023.
Touvron et al. [2023a] Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023a.
Touvron et al. [2023b] Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023b.
Veselovsky et al. [2023] Veniamin Veselovsky, Manoel Horta Ribeiro, and Robert West. Artificial artificial artificial intelligence: Crowd workers widely use large language models for text production tasks, 2023.
Wallace et al. [2020] Eric Wallace, Mitchell Stern, and Dawn Song. Imitation attacks and defenses for black-box machine translation systems. In EMNLP, 2020.
Wang et al. [2022] Yizhong Wang, Yeganeh Kordi, Swaroop Mishra, Alisa Liu, Noah A Smith, Daniel Khashabi, and Hannaneh Hajishirzi. Self-instruct: Aligning language model with self generated instructions. arXiv preprint arXiv:2212.10560, 2022.
Watson et al. [2021] Lauren Watson, Chuan Guo, Graham Cormode, and Alex Sablayrolles. On the importance of difficulty calibration in membership inference attacks. arXiv preprint arXiv:2111.08440, 2021.
Wei et al. [2022] Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoc V Le. Finetuned language models are zero-shot learners. In International Conference on Learning Representations, 2022.
Weidinger et al. [2022] Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, et al. Taxonomy of risks posed by language models. In 2022 ACM Conference on Fairness, Accountability, and Transparency, pages 214–229, 2022.
Wu et al. [2023] Yihan Wu, Zhengmian Hu, Hongyang Zhang, and Heng Huang. Dipmark: A stealthy, efficient and resilient watermark for large language models. arXiv preprint arXiv:2310.07710, 2023.
Xu et al. [2023] Canwen Xu, Daya Guo, Nan Duan, and Julian McAuley. Baize: An open-source chat model with parameter-efficient tuning on self-chat data. arXiv preprint arXiv:2304.01196, 2023.
Yeom et al. [2018] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st computer security foundations symposium (CSF), pages 268–282. IEEE, 2018.
Yoo et al. [2024] KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit watermark for large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 4031–4055, 2024.
Zhao et al. [2023] Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. arXiv preprint arXiv:2302.03162, 2023.
Zhao et al. [2024] Xuandong Zhao, Lei Li, and Yu-Xiang Wang. Permute-and-flip: An optimally robust and watermarkable decoder for llms. arXiv preprint arXiv:2402.05864, 2024.

Appendix A Limitations

•
Our research specifically explores the radioactivity of LLM watermarks originally designed for detecting AI-generated text. Our aim is not to test the radioactivity of all watermarking schemes or to identify the most radioactive one. Instead, we aim to develop a general method for detecting radioactivity, applicable to similar decoding-based watermarks. Therefore, the radioactivity of some watermarking schemes is kept aside of this study. We detail this point about the generalization of our work to other watermarking schemes in App. G.1.
•
We discuss various parameters that influence radioactivity and how it is linked to the robustness of the used watermark, in Sec. 6 and App. F. While we have tried to span as many factors as possible, we acknowledge that some are missing. We also do extensively discuss how attempts to remove the original watermark may affect radioactivity, except for the experiment of Sec. 6.3 where Bob re-fine-tunes his model. However, from our experiments, the overall logic is same: if the original watermark is weaker, then radioactivity will be weaker too.
•
The computational efficiency of the proposed algorithms is linear in the number of tokens to analyze and depends on the suspected LLM. In the closed-model setting, we need to query the model about 1000 times to detect radioactivity confidently, which could be a limitation if the suspect model is only available through an API.
•
One objective of Sec. 5 is to demonstrate that we can detect radioactivity with high confidence in a realistic setting. From this, we assert in the abstract that we can detect radioactivity with a -value of , even when only as little as 5% of the fine-tuning instruction/answer pairs are watermarked (open/unsupervised setting). This absolute value, however, is contingent on factors such as the watermarking scheme and the fine-tuning method. We do not claim that 5% is a universally sufficient watermarking proportion for all fine-tuning scenarios. Nevertheless, the relative insights derived from the -values in Sec.5 will always hold true. For instance, that the open-model method outperforms the closed-model method.

Appendix B Broader Impacts

B.1 Societal impact

The societal impact of this work includes positive and negative aspects. On the one hand, it can assist proprietary LLMs in preventing imitation and protect their intellectual property. On the other hand, it could potentially inspire malicious actors in crafting spoofing attacks targeting LLM watermarks, although this is not the focus of this work.

B.2 Environmental impact

The cost of the experiments and of model fine-tuning is high, though order of magnitude less than other LLM papers. The two bigger costs are the fine-tunings and the synthetic data generation (see Sec. B.3). We also roughly estimate that the total GPU-days used for running all our experiments to , or k GPU-hours. This amounts to total emissions in the order of tons of CO₂eq. Estimations are conducted using the Machine Learning Impact calculator presented by Lacoste et al. [2019]. We do not consider in this approximation: memory storage, CPU-hours, production cost of GPUs/ CPUs, etc.

B.3 Compute resources

For our experiments, we utilized an internal cluster.

•
The generation of both watermarked (100k instruction/answer pairs) and non-watermarked (100k instruction/answer pairs) instructions took approximately one day on a single node equipped with 8 V100 GPUs. This process was repeated 5 additional times for the experiments on the watermark window size of Table 5 for both Aaronson and Kirchner [2023] and Kirchenbauer et al. [2023b].
•
Each main experiment in Sec. 5 involved the fine-tuning of a 7B model, which took approximately eight hours on a single node with 8 V100 GPUs. Radioactivity detection in the closed-model setting required prompting the model approximately times, which took around five hours on a single V100 GPU.
•
Each subsequent radioactivity detection test took less than 30 minutes and did not require a GPU. For the open-model setting, no additional generation was needed. We simply forwarded 1M tokens in batches, which took approximately two hours with a single GPU.

Appendix C Details on LLM Watermarking

We use the notations presented in Sec. 2.2. This paper considers the watermarking methods [Kirchenbauer et al., 2023a, b, Aaronson and Kirchner, 2023] which alter the logit vector or the probability vector when trying to generate , depending on the window of previous tokens in the context: ( is an integer between 0 and the size of the vocabulary).

A hash function maps these tokens to a random seed. The hash function also depends on a secret key . In our work, the hash function operates according to the equation:

for , and . In this equation, is the updated hash value, is the current hash value, is a constant, is the current input token, is the modulus operator, and is the modulus value. The final seed () is used to initialize a random number generator (RNG). RNG is then used to influence or determine the next token’s choice .

C.1 Kirchenbauer et al. [2023b]

RNG is used to create a greenlist containing tokens, where . The logit of every token in the greenlist is incremented by . The sampling then proceeds as usual. Intuitively, this encourages the generation of greenlist tokens by increasing their probability.

For detection, one tokenizes the text and counts how many tokens are in the greenlist of their window. More formally, we consider a text of tokens. Recall that . A statistical test on the cumulative score is then performed based on tuples , where each is a -tuple of tokens and token is generated from the preceding tokens . Each tuple also includes an optional context (e.g., prompt). The cumulative score associated with is the number of greenlist tokens, which in the absence of a watermark follows a binomial distribution:

(3)

The statistical test considers two hypotheses, : “the text is natural” against : “the text was generated with watermark”. Under , we suppose that the -valued random variables are independent and identically distributed as a Bernoulli distribution with parameter . Therefore, follows a binomial distribution with parameters and . The -value of a test associated with score , i.e., probability of obtaining a score higher than under , can be obtained theoretically from:

(4)

where is the regularized incomplete Beta function. Under , the score is likely to be higher than under , so the -value is likely to be lower.

The strength of the watermark is mainly controlled by the parameter . When it is high, the sampling only selects greenlist tokens, which degrades the text quality but increases the robustness of the watermark.

C.2 Aaronson and Kirchner [2023]

RNG is used to generate a random vector . Then, instead of sampling from distribution , the next token is chosen by (nucleus sampling or top- can be applied to before computing ). Intuitively, this encourages the generation of tokens that have a high value. It also presents the interesting property that , . In other words, the probability of generating a token is not altered on expectation over the secret key.

For detection, one goes through all tokens. At time-step , the previous tokens are used to retrieve the key vector . We denote by the number , i.e., the value of the key vector for the token in the text. The score is now:

(5)

and with the notations of Sec. 2.2:

We consider the same hypothesis testing as before. Under , we assume that and that are i.i.d., so follows a distribution. The -value of a test associated with score reads:

(6)

where is the upper incomplete gamma function. Under , the score is expected to be higher. In fact, its expectation is lower-bounded by , where is a positive constant and is the entropy of the generated text.

The strength of the watermark is directly linked with the temperature of the softmax. For instance, for very high values of , the softmax outputs an almost uniform probability vector , so the choice of the next token is determined entirely by (the token with highest value is chosen) – whereas for very low , distribution is very peaky so has little influence.

Appendix D Score Computation

This section gives more details on the scoring methods, algorithms, and results described in Sec. 4.

D.1 Reporting

Log -values.

Given that -values often span various orders of magnitude, we consistently report the average of the over multiple runs rather than the average of the -values themselves. In the main text, we interpret the average as though it could be directly read as a -value (for instance, if the average is , we interpret it as if Alice would be incorrect to reject the null hypothesis only once in 10,000 instances). However, this is a simplification, as a direct translation to a rigorous statistical -value is not really possible. Therefore, we show the box-plots with additional statistics in Fig. 7.

Average over multiple runs.

Due to computational constraints, the standard deviations for the are not calculated across multiple models trained on different instruction data for each setting. Instead, for each setting, we generate the same volume of data (14M tokens, see section 5) in addition to the data used to fine-tune . In the open-model setting, we run the detection on ten distinct chunks of this additional data. In the closed-model/unsupervised setting, we prompt with ten different chunks of new (non-watermarked) sentences and score the responses. For the closed-model/fully supervised setting (results reported in Fig. 6), we score the answers from to all the prompts present in , which for of watermarked fine-tuning data only represent k tokens. It explains the absence of confidence intervals.

Figure 7: Box plot for the in the open/unsupervised setting with varying , the proportion of ’s fine-tuning data watermarked. This corresponds to the values presented in Fig. 6 where the means are reported.

D.2 Correctness

We focus here on the correctness of the tests used in this work to detect radioactivity. App. D.2.1 gives the proof of validity for the radioactivity detection test proposed in Sec. 4.1 and surfaces another point of view for this test. App. D.2.2 gives more details on why de-duplication is important in various scenarios. Finally App.D.2.3 empirically shows that the detection tests provide reliable -values.

D.2.1 Proof of correctness for radioactivity detection

We give the proof of Proposition 1 of Sec. 4.1 for the watermark of Kirchenbauer et al. [2023a]. In this context, we remind that is “ follows a binomial distribution ”.

Proposition 2.

“B was not trained on Alice’s watermarked data” if are independent and independent of Alice’s Watermarking process. In practice, this is achieved if tokens are de-duplicated: (1) are pairwise distinct and (2) for each , is not in the context .

Proof.

With (2), the de-duplication excludes the possibility of simply repeating watermarked tuples from the prompt. Moreover, assuming an ideal hashing function, there is no correlation between the green lists of different watermark windows, so this simple rule ensures that each -tuple has a probability of contributing to an increase in the score. If (1) also holds, is a set of unique -tuples of tokens, which is used to simulate independent score increments in watermarking detection [Kirchenbauer et al., 2023b, Fernandez et al., 2023]. Therefore by definition of in (2), are i.i.d. simulations distributed according to a Bernoulli distribution with parameter . Thus, follows a binomial distribution . ∎

Note that the exact same arguments are valide for other hashing-based watermarks.

An alternative choice of for radioactivity detection.

Sec. 4.1 adopts a definition of , which we show is adequate to radioactivity detection if de-duplication is carefully done. Another approach closer to classical watermarking is also possible. Specifically, Kirchenbauer et al. [2023a] define as “The text sequence is generated with no knowledge of the red list rule.”. If we keep the same for radioactivity, the goal of de-duplication is to modify the score computation such that we know the distribution of this score under . Filtering/de-duplication does not change the null hypothesis. It only modifies the observation from which we compute a score such that we know the distribution of this score under . This process may not be optimal, but at least we are sure that the output probability is a -value. The -value is computed as the probability , where is defined in (2). The probability is computed implicitely over the secret key . Works in the literature resort to bounds (e.g., Markov), or to estimation from random simulations (Monte Carlo, like Kuditipudi et al. [2023] do). We prefer to use a sub-optimal test (due to filtering/de-duplication) whose -values are sound. This view and the one detailed in Sec. 4.1 are strictly equivalent, but having the two in mind can help to mentally navigate the necessity of the de-duplication rules.

D.2.2 More details on token scoring and de-duplication

Sec. 4.1 overviews why scoring all tokens might introduce bias in the score computation, which makes the statistical test inadequate to radioactivity detection. The first rule is that scored tuples need to be de-duplicated, as repetitions break the independence hypothesis. This is even truer when the number of analyzed tokens grows (bigger than in the experiments of this paper). A mitigation for this bias was proposed by Kirchenbauer et al. [2023a], Fernandez et al. [2023] by scoring only distinct -tuples watermarked window), or -tuples watermarked window + current token ). By default we score distinct -tuples as it allows to score more tokens. This de-duplication ensures independence between the scored tokens, which is the central hypothesis of the watermark detection test; we refer the reader to [Fernandez et al., 2023] for details.

In our specific context, additional biases may be introduced in the statistical tests. These biases can occur when we prompt the model with watermarked text or when we apply the “reading mode” (Figure 3) to watermarked data in the open-model setting. These biases, which are illustrated in Tab. 5, differ from those addressed by the aforementioned de-duplication method. Indeed, in our scenario, it is crucial to ensure that the suspect model generates watermarked tokens naturally, rather than merely repeating a watermark that’s already present in its attention span. To address these biases, the second de-duplication discussed in Sec. 4 is necessary: we show how it is useful for different scenarios in the following paragraphs. The underlying rationale is always that the watermark operates at the -gram level. Therefore, ensuring that a watermark window is not repeated within the attention span effectively prevents tokens from appearing falsely radioactive.

Closed-model.

For the instruction fine-tuning setup of Sec. 5, we prompt with watermarked questions from . In this setting, Alice suspects Bob to have trained his model on (some) question/answers pairs from . Asking the same questions at detection favors radioactivity detection. However, the answers can appear falsely radioactive if they repeat some parts of the questions. For instance, if a watermarked instruction from is: “Repeat the sentence ”, then at detection time, will probably answer , which, if scored as such, will appear radioactive. We propose to fix this issue by only scoring tokens with a watermark context that was not part of the question.

Open-model.

In the open-model setting, we only score -grams that are not already part of ’s attention span when generating the next token. This is because if a -gram is present at the beginning of the sentence, it is more likely to be repeated by , thus appearing falsely radioactive. Except for these cases, we score distinct -grams. This was used in Sec. 5 and Sec. 6.

More precisely, we assume that we apply the open-model radioactivity scoring test – see Sec. 4 – on a sentence generated by with the watermark of Kirchenbauer et al. [2023a]. Assume that contains the sentence “Weather forecast: The weather is nice. The weather is nice.” and that “nice” is in the greenlist of “weather is ”. When pass-forwarding through , the most likely next token after “Weather forecast: The weather is nice. The weather is ” might be “nice” according to ’s decoding. However, this can be because it is influenced by the beginning of the sentence : “The weather is nice”. Therefore, “nice” will appear falsely radioactive. We show that only scoring the token that generates after the first occurence of the -gram “the weather is ” in mitigates this issue.

Figure 8: -value under with closed-model access. We fine-tune on non-watermarked instructions. We prompt with watermarked instructions and score the disctinct -grams from the answers, but only if the -gram was not part of the instruction. The average is close to 0.5 (expected under ).

Figure 9: -value under with open-model access. We fine-tune on non-watermarked instructions. We apply the open-model detection of Sec. 4 and score distinct -grams, but only on -grams that did not previously attend to when generating the token. The average is close to 0.5 (expected under ).

D.2.3 Correctness experiments

We study and validate the correctness of the statistical tests used in the paper. In our tests, the null hypothesis represents when Bob’s model was not fine-tuned on any data watermarked by Alice’s method and key (). Instead of fine-tuning model with many different datasets and running the detection on fixed texts and a fixed watermarking algorithm and key, we rather choose to vary the hyper-parameters of the detection algorithm at a fixed fine-tuned model (to save computation and memory). In the following is therefore the model fine-tuned on non-watermarked instructions (as presented in Sec. 5).

Closed-model.

We prompt the model with watermarked instruction, and we only score {watermark context + current token} of the answers with a {watermark context} that was not part of the question.

To validate our tests, we prompt with k watermarked instructions in the same setup as in Sec. 5: using the method by Kirchenbauer et al. [2023b] with and and three different seed . We then score the answers (with the same seed used to generate the instructions) using the proposed de-duplication. We repeat this times on different questions, and show the average and standard deviations in Fig. 9. We demonstrate that after scoring 750k tokens, the -value is approximately 0.5 under the null hypothesis (), albeit slightly lower. In Section 5, we scored k tokens in the closed/supervised setting. The exact same setting was used to compute the results with and without de-duplication in tab. 5 of sec. 5.

Open-model.

To validate our tests in the open-model scenario we proceed as follows:

•
We generate text with eight distinct watermarks. We use four different values for the watermarking method proposed by Aaronson and Kirchner [2023] with . Similarly, we use four different values for the watermarking method proposed by Kirchenbauer et al. [2023a] with .
•
For each configuration, we divide our dataset into three segments. Then, we apply the radioactivity detection test described in Sec. 4 on these 24 segments, each containing more than 1.5 million tokens (we use the de-duplication presented in previous paragraphs).

Please note that all texts are generated using the same seed , which is also used by Alice during the detection process. Indeed Alice is aware of the watermarking scheme she is using. We calculate the mean and standard deviations for all these segments. In Fig. 9, we demonstrate that after scoring 1.5 million tokens, the -value is approximately 0.5 under the null hypothesis (), albeit slightly lower. One likely explanation for the small bias is the fact that while de-duplication ensures some independence between -grams, there may still be some dependencies between -grams for .

Appendix E Discussion on Other Approaches

E.1 Membership inference

Method.

In the open-model/supervised, MIA evaluates the radioactivity of one sample/sentence by observing the loss (or perplexity) of on carefully selected sets of inputs. The perplexity is expected to be smaller on samples seen during training. We extend this idea for our baseline radioactivity detection test of a non-watermarked text corpus. The corpus of texts is divided into sentences (of 256 tokens) and ’s loss is computed on each sentence. We calibrate it with the zlib entropy [Roelofs, 2017], as done by Carlini et al. [2021] for sample-based MIA. The goal of the calibration is to account for the complexity of each sample and separate this from the over-confidence of .

We test the null hypothesis : “the perplexity of on has the same distribution as the perplexity on new texts generated by ”. Indeed, if was not fine-tuned on portions of , then necessarily is true. To compare the empirical distributions we use a two-sample Kolmogorov-Smirnov test [Massey, 1951]. Given the two cumulative distributions and over loss values, we compute the K-S distance as . We reject if this distance is higher than a threshold, which sets the p-value of the test, and conclude that is radioactive for . This is inspired by Sablayrolles et al. [2018], who perform a similar K-S test in the case of image classification. It significantly diverges from the approach of Shi et al. [2023], which derives an empirical test by looking at the aggregated score from one tail of the distribution.

Experimental results.

We proceed as in Sec. 4 for the setup where MIA is achievable: Alice has an open-model access to and is aware of all data generated for Bob (supervised setting). Bob has used a portion for fine-tuning , given by the degree of supervision , as defined in Sec. 3. We use the K-S test to discriminate between the calibrated perplexity of on: containing 5k instruction/answers (cut at 256 tokens) that were not part of ’s fine-tuning; and containing 5k instruction/answers from which were. Distribution simulates what happens when Bob generates a lot of data and only fine-tunes on a few.

(a) Distributions of the calibrated loss of across two types of distributions generated by : texts generated by outside of ’s fine-tuning data ( purple), texts of of which were used during training ( orange).

(b) We report the p-values of the K-S detection test (no WM when training) and of the WM detection ( of WM when training) against the degree of supervision (proportion of Bob’s training data known to Alice).

Figure 10: Comparative analysis of membership inference and watermarking for radioactivity detection, in the open-model setup. (Left) MIA aims to detect the difference between the two distributions. It gets harder as decreases, since the actual fine-tuning data is mixed with texts that Bob did not use. (Right) Therefore, for low degrees of supervision (), MIA is no longer effective, while WM detection gives p-values lower than .

Experimentally, we use the K-S test to discriminate between the calibrated perplexity of on: containing 5k instruction/answers (cut at 256 tokens) that were not part of ’s fine-tuning; and containing 5k instruction/answers from which were. Distribution simulates what happens when Bob generates a lot of data and only fine-tunes on a few.

10(a) compares the distributions for and . As decreases, the data contains more texts that Bob did not fine-tune on, so the difference between the two perplexity distributions is fainter. The direct consequence is that the detection becomes more challenging. 10(b) shows that when , the test rejects the null hypothesis at a strong significance level: implies that when radioactive contamination is detected, the probability of a false positive is . It is random in the edge case , the unsupervised setting where Alice lacks knowledge about the data used by Bob. In contrast, radioactivity detection on watermarked data succeeds in that setting.

E.2 IP protection methods

There are active methods that embed watermarking in a text specifically to detect if a model is trained on it [Zhao et al., 2023, He et al., 2022b, a]. Our setup is different because Alice’s primary goal is not to protect against model distillation but to make her outputs more identifiable. Consequently, “radioactivity” is a byproduct. Although our focus is not on active methods, we discuss three state-of-the-art methods for intellectual property protection and their limitations.

Zhao et al. [2023].

The goal is to detect if a specific set of answers generated by Alice’s model has been used in training. There are three main limitations. The authors design a watermark dependent on the previous prompt (and unique to it). Each detection algorithm (2 and 3) assumes that the sample probing data is from the training data of the suspect model . Therefore, the method is only demonstrated in the supervised setting. Moreover, all experiments are performed in the open-model setting, where Alice has access to ’s weights, except for Sec. 5.2 “Watermark detection with text alone” (still assuming a supervised access), where one number is given in that setting. Finally, it does not rely on a grounded statistical test and requires an empirically set threshold.

He et al. [2022a] and He et al. [2022b].

These methods substitute synonyms during generation to later detect an abnormal proportion of synonyms in the fine-tuned model. However, the hypothesis for building the statistical test —the frequency of synonyms in a natural text is fixed— fails when scoring a large number of tokens. Using the official author’s code on non-watermarked instruction-answers yields extremely low p-values, making the test unusable at our scale, as shown in Table 9.

Table 9: p-values for non-watermarked instruction-answers

Number of lines	Number of characters (in thousands)	p-value
10	1.5	0.76
100	30.9	0.16
500	148.3	2.2
1000	333.9	8.8

Appendix F Additional Results

F.1 Qualitative examples

Figure 15 shows example of answers from Llama-2-chat-7B, when asked to generate new intruction/answer pairs. Figure 16 shows examples of answers from Llama-1-7B, after the instruction fine-tuning from 100k instructions, from which a proportion is watermarked.

Table 10: Summary statistics (mean and standard deviation) of of the watermark detection for different ranges of number of tokens constituting the text. Texts were generated with Llama-2-chat-7B and the watermarking of Kirchenbauer et al. [2023b], with , , , as in Sec. 5, and each range contains 500 texts.

Range

(50, 150]

(150, 250]

(250, 350]

(350, 450]

(450, 550]

(550, 650]

(650, 750]

Mean

-7.2

-11.7

-15.9

-18.4

-21.0

-24.0

-26.6

Std

3.6

5.6

7.2

8.8

10.2

12.6

14.2

F.2 Evaluation of the watermarking

We evaluated in Sec. 5.2 the LLM fine-tuned on watermarked data. Table 10 describes the results in terms of detection and quality of the text that was used for fine-tuning. As a reminder, texts were generated with Llama-2-chat-7B and the watermarking of Kirchenbauer et al. [2023b], with , and watermark window , as in Sec. 5. For instance, the over 500 texts made of 50 to 150 tokens is at on average.

F.3 Bigger teachers

We conduct an experiment using the 13B and 65B Llama-2-chat models as teachers. The teacher generates instruction-answer pairs using the watermarking method and parameters specified in the paper (KGW, , ), which are then used to fine-tune a Llama-1-7B model. Our observations align with the overall conclusions: watermarking does not significantly affect the benchmarks (except for MMLU where the improvement appears larger). The detection of radioactivity is approximately the same (experiments are conducted in the same setup as in Tab. 6).

F.4 Mixing instruction datasets from different sources

We conduct an experiment where the non-watermarked instructions are human-generated (from the Open Assistant dataset OASST1 Köpf et al. [2024]). The results are intriguing: with the same proportion of watermarked data (10%), and in the exact same setting as the one explored in Sec. 5.3, the radioactivity signal is even stronger (see Tab. 12). Our speculation is that this might be due to fewer overlapping sequences of +1-grams between the two distributions.

Table 11: Results for different teacher models.

Teacher	without	7B	13B	65B
NQ	3.2	5.6	5.4	5.8
GSM8k	10.0	11.1	10.4	11.0
MMLU	28.4	31.0	32.9	33.8
p-value	-0.3	-32.4	-31.1	-31.7

Table 12: Mixing instruction datasets from different sources. The fine-tuning is done with the setup presented in Sec. 5, with = of watermarked data, mixing either with human or synthetic instructions.

Major data source	Average
Machine	-15
Human	-32

F.5 Number of epochs

Figure 11 extends results presented in Tab. 6. The setting is similar to the one presented in Sec. 6, i.e., of instructions are generated with watermarking [Kirchenbauer et al., 2023a]. We observe the radioactivity on =10k tokens. As a reminder, in Sec. 5, we perform 3 epochs of fine-tuning, as done for Alpaca [Taori et al., 2023].

Figure 11: Detailed results for the influence of the number of epochs when is fine-tuned on of watermarked data. The longer the fine-tuning lasts, the more the watermarking leaves traces in the model.

Figure 12: Detailed influence of the filter. Box plots of the in the closed-model setting with . We perform the watermark detection test on text generated by . The baseline uses the default scoring (no filters). In the unsupervised scenario, scoring is confined to -grams generated in new watermarked data produced by . In the supervised scenario, scoring is limited to -grams present in .

Table 13: Detection results in the closed-model setting, with and without filters on scored -grams. We report the mean and max over 10 runs. Filtering scored -grams improves the detection, even more so in the worst-case scenarios. See Fig. 12 for the corresponding box blots, and App. F.6 for experiment details.

Baseline	Unsupervised	Supervised
-4.7	-5.2	-5.5
-1.9	-2.4	-3.7

F.6 Impact of the filter

In both the supervised and unsupervised closed-model settings, the use of a filter is paramount. As explained in section 4, the watermark traces in can only be detected in the -grams that are part of (refer to subsection 2.2 for details on watermark embedding). Assuming that these -grams are heavily watermarked and that has memorized all of them, they still only represent a small fraction of the total -grams that can be tested. To enhance detection, we define a set of -grams likely to have been trained on. Tokens are only scored if their preceding -gram window (the watermark context window used for hashing) is part of . This approach concentrates the score computation on -grams where the watermark could potentially be learned. In the fully supervised setting (), consists of the -grams used during training, i.e., all -grams from . In the unsupervised setting, we still focus on “likely” contaminated sets of tokens, for instance, -grams that appear in a new text generated by with the watermark. Note that filter is only used in the closed-model setting.

In addition to Fig. 6 shown in the main text, we show box plots in Fig. 12. To isolate the effect of the filter alone and to compare the results on different chunks, we use the same non-watermarked prompts in all settings and analyze the same number of generated tokens M answered by . Thus, for the supervised setting, it differs from what is done in Fig. 6 and Fig. 6 where we use the watermarked prompts from . Both filtering methods show improvements compared to the baseline. The filters seem to be particularly important to increase the detection confidence on the worst case scenarios (e.g., in our case, the biggest observed over the 10 runs). Table 13 reports the same results in a table. Both figures correspond to (setting of Sec. 5). Note that we expect the filter to be even more efficient for higher values of .

F.7 Open vs. Closed

Figure 13 compares detection in the open and closed-model settings, when of fine-tuning data are watermarked. The setup is the one from Sec. 5. We plot the against the number of generated next tokens, averaged over 10 different runs. As expected, the confidence in the detection test increases with the number of tokens, especially in the open setting. For instance, at k generated tokens, the average of the closed-model detection is at , while it is at for the open-model detection presented in Sec. 5.

Figure 13: in the unsupervised setting with of ’s fine-tuning data watermarked as a function of the number of generated tokens. For the closed-model scenario, we perform the watermark detection test on new text generated by , and only score -grams that are often produced by ’s watermark.

Appendix G Generalization to Other Watermarking Methods

We discuss the generalization of our methods to other text watermarks. Sec. G.1 focuses on other hashing-based methods, and the limit of our approach for non hashing-based ones. Sec. G.2 explores the radioactivity of a multi-bit watermarking scheme.

G.1 Does the radioactivity generalize to other watermarking zero-bit schemes?

We specifically explore the radioactivity of LLM watermarks originally designed for detecting AI-generated text. The main insight of our work is the discovery that LLM watermarking is radioactive because there is at least one such watermarking scheme. Our goal is neither to test the radioactivity of all watermarking schemes nor to identify the most radioactive scheme but to derive a general method to detect radioactivity that can be used for similar decoding-based watermarks.

Key management based on hashing.

As in most of the LLM watermarking literature (Fu et al. [2024a, b], Hu et al. [2023], Kirchenbauer et al. [2023b], Kuditipudi et al. [2023], Wu et al. [2023], Zhao et al. [2024], …), we focus on the works of Aaronson and Kirchner [2023], Kirchenbauer et al. [2023a] that are representative of the 2 main families of methods. They are also among the few that provide reliable -values for detection.

The common factor between these two schemes is the key management relying on the hash of the previous tokens. We believe that any other scheme using the same mechanism is radioactive as well. Lee et al. [2023] modify the watermark of Kirchenbauer et al. [2023b] (green list/red list) so that it works better for low entropic texts (the paper focuses on code). Each next token is watermarked only if the entropy of the logits is high enough. Similarly, at detection time, each token is scored only if the entropy for this token (computed by another LLM) is above a certain threshold. Radioactivity can be detected using the methods derived in our work. Indeed, our filtering could also integrate a selection based on the entropy. Fu et al. [2024a] use a similar idea than Aaronson and Kirchner [2023] but with another sampling function. There too, radioactivity can be measured with our tools.

Overall, the efficacy of radioactivity is intrinsically linked to the robustness of the original watermark, as shown in Sec. 6. Section 5 uses a watermark window size of , which isn’t the least robust nor the most robust scenario but a realistic one for which we derive the main results.

Other schemes.

There are few LLM watermarking schemes not relying on hashing. For instance, some focus on “semantic” watermarks that depend on an entire past text’s semantic representation [Liu et al., 2023, Liu and Bu, 2024, Fu et al., 2024b]. [Kuditipudi et al., 2023] represents another family of methods that do not operate via hashing but with pre-defined key sequences chosen depending on the token’s position. However, we do not evaluate the radioactivity of these methods due to the lack of -value computation. This limitation is also noted in other studies (see [Piet et al., 2023] paragraph 7.3. Limitations of the Building Blocks).

For example, Kuditipudi et al. [2023] compute a score using the Levenshtein distance of a given block size whose complexity is over tokens, watermark key sequences, and a block size . If we approximate and to 100 ( and in their codebase), this implies that the complexity is times greater than that of the schemes presented previously. Next, the score is empirically mapped to a -value thanks to a Monte Carlo simulation involving different keys. To evaluate -values of (as in the main paper), we would need to run this statistic over times, so it would require times more operations in total. Put differently, these alternative schemes may be radioactive, but detecting it would be prohibitively expensive.

G.2 Multi-bit scenario

We adopt the same framework as in Sec. 5, but we use the watermarking method of Yoo et al. [2024], a.k.a., MPAC. It is a multi-bit method, where the watermark is a binary message of size . More precisely, we take bits 2 by 2 to generate a message with the -ary or , corresponding to and with the notations from the original paper. The method proceeds as the one of Kirchenbauer et al. [2023b] by altering the logits before generating a token. However, the hash created from the watermarked window and the key is now used (1) to randomly partition the vocabulary into disjoint sets, (2) to select the position and corresponding that is hidden for this particular token. A bias is added to the logits of the tokens belonging to the -th set. Given a text under scrutiny, the extraction reverses the process to find which -ary is the most likely for each position of the message.

We report in Fig. 14 the extraction results in the the supervised/closed-model setup. We filter and deduplicate the tokens as in Sec. 5, and plot the observed bit accuracy against the number of scored tokens – note that since the watermark is a binary message, we now measure the bit accuracy of the extraction, instead of the p-value of the detection. This is done for several lengths of the binary message. Every experiment is run times for different text output by , which explains the confidence interval in the plots. We observe as expected that the bit accuracy significantly increases with the proportion of watermarked data in the fine-tuning data, and that the longer the message, the harder it is to extract it. This suggests that radioactivity still holds in the multi-bit scenario, and could therefore be used to identify a specific version of the model or a specific user from which the data was generated.

Figure 14: Bit accuracy when watermarked instruction data are generated with MPAC [Yoo et al., 2024], against the number of scored tokens generated by the fine-tuned model. This is done under the supervised/closed-model setup, for various lengths (=8, 16, 32) of the message.

Figure 15: Example of instruction data using Self-instruct. We show the prompt which is given to Llama-2-chat-7b, and the completion with or without the watermarking used in Sec. 5. We don’t observe noticeable quality decrease.

Figure 16: Example of generated answers from Bob’s model (Llama-1), fine-tuned on instruction data generated by Alice’s model (Llama2-chat) with different proportions of watermarked data. See Figure 15 for example of instructions used for instruction-tuning.

NeurIPS Paper Checklist

1.
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
Answer: [Yes]
Justification: The main claims in the abstract and introduction reflect that (1) we study the problem of knowing whether outputs of a model were used to train another model, (2) we derive methods to detect radioactivity with reliable statistical guarantees and (3) it can be used to identify model imitation in a realistic scenario.
Guidelines:
- •
  The answer NA means that the abstract and introduction do not include the claims made in the paper.
- •
  The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
- •
  The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
- •
  It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2.
Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: See section A
Guidelines:
- •
  The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
- •
  The authors are encouraged to create a separate "Limitations" section in their paper.
- •
  The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
- •
  The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
- •
  The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
- •
  The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
- •
  If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
- •
  While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren’t acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3.
Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: The main theoretical results rely on proofs presented in previous papers. Experiments are made in the core text to validate the reliability of theoretical -values (Tab. 5), and details are given in App. C and App. D.2.
Guidelines:
- •
  The answer NA means that the paper does not include theoretical results.
- •
  All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced.
- •
  All assumptions should be clearly stated or referenced in the statement of any theorems.
- •
  The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
- •
  Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
- •
  Theorems and Lemmas that the proof relies upon should be properly referenced.
4.
Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We give exhaustive information on how to reproduce the experiments presented in the paper in sections 5 and 6.
Guidelines:
- •
  The answer NA means that the paper does not include experiments.
- •
  If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
- •
  If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
- •
  Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
- •
  While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
  1. (a)
    If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
  2. (b)
    If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
  3. (c)
    If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
  4. (d)
    We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5.
Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: Including a checkpoint of a 7B model derivative of Llama necessitates agreements, and without it, reproducing the results would not be possible. We nevertheless provide code to reproduce the detection experiments. For the instruction generation code, we refer to the code of Wang et al. [2022], and for the fine-tuning code, we refer to Taori et al. [2023].
Guidelines:
- •
  The answer NA means that paper does not include experiments requiring code.
- •
- •
  While we encourage the release of code and data, we understand that this might not be possible, so “No” is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
- •
  The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https://nips.cc/public/guides/CodeSubmissionPolicy) for more details.
- •
  The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
- •
  The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.
- •
  At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
- •
  Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6.
Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The finetuning parameters are not optimized (we use canonical values). We also detail our choice for the watermark parameters. Refer to Sec. 5.
Guidelines:
- •
  The answer NA means that the paper does not include experiments.
- •
  The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
- •
  The full details can be provided either with the code, in appendix, or as supplemental material.
7.
Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: For most of our experiments, we plot results averaged over several runs, and show error bars (we disclose the details of their computations in App. D.1).
Guidelines:
- •
  The answer NA means that the paper does not include experiments.
- •
  The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
- •
  The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
- •
  The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
- •
  The assumptions made should be given (e.g., Normally distributed errors).
- •
  It should be clear whether the error bar is the standard deviation or the standard error of the mean.
- •
  It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.
- •
  For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
- •
  If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8.
Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: see App. B.3
Guidelines:
- •
  The answer NA means that the paper does not include experiments.
- •
  The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
- •
  The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
- •
  The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn’t make it into the paper).
9.
Code Of Ethics
Answer: [Yes]
Justification: The research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Guidelines:
- •
  The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
- •
  If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
- •
  The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).
10.
Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: see App. B
Guidelines:
- •
  The answer NA means that there is no societal impact of the work performed.
- •
  If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
- •
  Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
- •
  The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
- •
  The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
- •
  If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11.
Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [N/A]
Justification: Our research does not pose such risks
Guidelines:
- •
  The answer NA means that the paper poses no such risks.
- •
  Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
- •
  Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
- •
  We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.
12.
Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We use the Llama family of models for training and synthetic data generation (Llama 2 Community License), and sentences from Wikipedia in Sec. 6 or OASST1 in App. F, which have a permissive license.
Guidelines:
- •
  The answer NA means that the paper does not use existing assets.
- •
  The authors should cite the original paper that produced the code package or dataset.
- •
  The authors should state which version of the asset is used and, if possible, include a URL.
- •
  The name of the license (e.g., CC-BY 4.0) should be included for each asset.
- •
  For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
- •
  If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
- •
  For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
- •
  If this information is not available online, the authors are encouraged to reach out to the asset’s creators.
13.
New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [N/A]
Justification: Not Applicable
Guidelines:
- •
  The answer NA means that the paper does not release new assets.
- •
  Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
- •
  The paper should discuss whether and how consent was obtained from people whose asset is used.
- •
  At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14.
Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [N/A]
Justification: Not applicable
Guidelines:
- •
  The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
- •
  Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
- •
  According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15.
Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [N/A]
Justification: Not applicable
Guidelines:
- •
  The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
- •
  Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
- •
  We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
- •
  For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Search across your past Websets

Articles: jailbreaking LLMs methods, ethical implications, reputable sources

Search Criteria

Enrichments

Find more results