Language model watermarks resist text deletion attacks with reed muller codes
RMCW: A Deletion-Robust Watermark Based on Reed--Muller Codes for Language Models
Cryptography and SecurityComputation and LanguageMachine Learning
Summary
Watermarks help identify text created by AI models but can be ruined if words are deleted or changed. The authors designed a new watermarking method using Reed--Muller codes that stays clear even when some words are removed. This method breaks the text into parts and looks for hidden math patterns that survive editing. Their tests show it catches AI-written text reliably, even after tricky changes. The idea is to make identifying AI-generated text more dependable.
What this means in practice
- •For content moderation teams: Detect AI-generated text in online posts even after words are deleted or rewritten to evade identification.
- •For corporate compliance officers: Identify internally generated AI text reliably to monitor compliance with content policies after document edits.
Authors
Yi Wang, Baicheng Chen, Yu Wang, Jian Zhao, Yilei Chen, Tianxing He
Abstract
Large Language Model (LLM) watermarking provides a lightweight mechanism for identifying text generated by a specific model, but its robustness remains fragile under post-processing attacks. Deletion attacks are particularly challenging because they shift token positions and break the alignment between observed tokens and their original watermark positions. We propose Reed--Muller Code Watermarking (RMCW), an LLM watermarking method based on Reed--Muller codes. In contrast to global codeword recovery, RMCW searches for surviving local algebraic structure, leveraging the Reed--Solomon consistency induced by affine-line restrictions of Reed--Muller codewords. During generation, RMCW injects a Reed--Muller structure into the sequence via a secret-keyed vocabulary partition. During detection, it maps the given text to keyed vocabulary bins and tests local subsequences for low-degree Reed--Solomon consistency using Berlekamp--Welch tests. Experiments on C4 and ELI5 datasets with OPT-1.3B and Llama-3.1-8B-Instruct show that RMCW preserves strong clean-text detectability and outperforms or matches the baseline methods under several deletion and rewriting attacks. Our code is available at https://github.com/BaichengDanny/RMCW.