Existing watermarking algorithms are vulnerable to paraphrase attacks because of their token-level design. To address this issue, we propose SemStamp, a robust sentence-level semantic watermarking algorithm based on locality-sensitive hashing (LSH), which partitions the semantic space of sentences. The algorithm encodes and LSH-hashes a candidate sentence generated by an LLM, and conducts sentence-level rejection sampling until the sampled sentence falls in watermarked partitions in the semantic embedding space. A margin-based constraint is used to enhance its robustness. To show the advantages of our algorithm, we propose a "bigram" paraphrase attack using the paraphrase that has the fewest bigram overlaps with the original sentence. This attack is shown to be effective against the existing token-level watermarking method. Experimental results show that our novel semantic watermark algorithm is not only more robust than the previous state-of-the-art method on both common and bigram paraphrase attacks, but also is better at preserving the quality of generation.

我们提出了一种基于局部敏感哈希（LSH）的鲁棒的句子级语义水印算法，通过将候选句子编码和LSH哈希一个由LLM生成的句子，并在语义嵌入空间中进行句子级拒绝采样，直到采样的句子落在带有水印的分区中，通过边缘约束来增强其鲁棒性，实验证明我们的算法不仅对常见和双字母语义重述攻击具有更强的鲁棒性，而且在生成质量上也更好。

SemStamp: 文本生成的语义水印及其释义鲁棒性