语言模型水印如何兼顾隐私与来源追踪
Reconciling Privacy with Provenance for Language Model Watermarks
AI 导读
一项 arXiv 研究提出将水印目标从追踪个体改为估计总体使用频率，从而调和隐私与来源追踪的矛盾。研究开发了本地差分隐私水印，并推出 Red-Green Sequence（RGS）水印，在高隐私水平下仍能准确估计使用频率。
正文 · 原文
Abstract:Watermarking has great potential for regulating the use of language models (LMs), but its deployment has been marred by controversy, as many users argue that fine-grained tracking of LM usage violates their privacy. This tension reduces the effectiveness of watermarks, as users engage in evasion strategies such as paraphrasing that can remove much of the watermark signal. We show that provenance and privacy can be reconciled if we shift the goal of watermark design from tracking individuals to estimating aggregate usage. We develop locally differentially private watermarks which provably limit the evidence that any individual text can contribute to detection, while still enabling accurate estimation of population frequencies. We introduce the Red-Green Sequence (RGS) watermark, a private and computationally efficient watermark that achieves accurate frequency estimation at high privacy levels across various models, sample sizes and generation entropies in settings that reflect realistic deployment scenarios. On C4 language modeling tasks, we attain $0.0019$ MSE with $0.0038$ mean absolute bias at a low $\varepsilon$ of 1, while in more challenging settings such as an essay writing task with only 100 text samples, we still find errors on the order of $0.0113$ MSE with $0.004$ mean absolute bias at $\varepsilon=2$.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2611.06100 [cs.CR] |
| (or arXiv:2611.06100v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2611.06100 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Elise Han [view email]
[v1]
Wed, 4 Nov 2026 07:45:02 UTC (2,625 KB)
来源：arXiv cs.AI · arxiv.org