{
  "id": "llm-watermark",
  "title": "A Watermark for Large Language Models",
  "authors": [
    "John Kirchenbauer",
    "Jonas Geiping",
    "Yuxin Wen",
    "Jonathan Katz",
    "Ian Miers",
    "Tom Goldstein"
  ],
  "author_parts": [
    {
      "given": "John",
      "family": "Kirchenbauer"
    },
    {
      "given": "Jonas",
      "family": "Geiping"
    },
    {
      "given": "Yuxin",
      "family": "Wen"
    },
    {
      "given": "Jonathan",
      "family": "Katz"
    },
    {
      "given": "Ian",
      "family": "Miers"
    },
    {
      "given": "Tom",
      "family": "Goldstein"
    }
  ],
  "equal_contribution": [
    "John Kirchenbauer",
    "Jonas Geiping"
  ],
  "year": 2023,
  "venue_date": "2023-07",
  "venue": "Proceedings of the 40th International Conference on Machine Learning",
  "venue_short": "ICML 2023",
  "publication_type": "conference",
  "publisher": "PMLR",
  "series": "Proceedings of Machine Learning Research",
  "volume": "202",
  "pages": "17061–17084",
  "doi": null,
  "arxiv_id": "2301.10226",
  "relation": "related",
  "categories": [
    "Watermarking",
    "Detection"
  ],
  "summary": "Embeds a statistical watermark by softly favoring a pseudorandom set of tokens during generation. It develops a detection test that does not require the language model and analyzes how the token distribution affects detection strength.",
  "relationship": "Its related-work section cites Neural Linguistic Steganography among earlier neural information-hiding methods. Its provenance-detection objective differs from concealing the existence of an arbitrary message.",
  "limitation": "Low-entropy text offers less freedom to embed a detectable signal without affecting quality; detection and robustness depend on text length, entropy, and adversarial modifications.",
  "sources": [
    {
      "url": "https://proceedings.mlr.press/v202/kirchenbauer23a.html",
      "evidence": "Full authors, ICML venue, July 23–29 2023, PMLR volume and pages; no publication DOI listed."
    },
    {
      "url": "https://arxiv.org/abs/2301.10226",
      "evidence": "First submission January 24, 2023; later revised versions distinguished."
    },
    {
      "url": "https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf",
      "evidence": "Title-page equal contributions/code; sections 1.2–5 cover entropy and robustness; related work cites Ziegler et al. 2019."
    }
  ],
  "arxiv_url": "https://arxiv.org/abs/2301.10226",
  "earliest_date": "2023-01-24",
  "earliest_date_label": "First arXiv submission",
  "url": "https://proceedings.mlr.press/v202/kirchenbauer23a.html",
  "pdf": "https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf",
  "code": "https://github.com/jwkirchenbauer/lm-watermarking",
  "category": "watermarking",
  "contribution": "Embeds a statistical watermark by softly favoring a pseudorandom set of tokens during generation. It develops a detection test that does not require the language model and analyzes how the token distribution affects detection strength.",
  "canonical_url": "https://steganography.live/reading-list/papers/llm-watermark/"
}