Filtering Resistant Large Language Model Watermarking via Style Injection

Abstract

The exorbitant cost of training Large Language Models (LLMs) makes it essential to protect the models from illegal copying and unauthorized usage. Recent attempts at LLM protection utilize black-box watermarking schemes, which embed distinctive input-output mapping (i.e., trigger set) directly into the models. However, most of them construct trigger inputs by injecting abnormal characters into normal text, which can easily be filtered out by unauthorized users, leading to a failure in watermark verification. In this paper, we propose a novel filtering-resistant LLM watermarking scheme, which takes advantage of imperceptible text styles to trigger the watermark. To achieve this, we adopt a trigger generation network to transform normal text into stylized sentences, which are assigned a specific watermarking label to build the trigger set. We then fine-tune the LLMs on both the trigger sets and clean samples for watermark embedding and performance stabilization. To boost watermark accuracy, we further propose a feature separation loss term to distinguish between normal and trigger inputs. Experimental results indicate the effectiveness of our proposed scheme for resisting the filtering attack.