Text watermarks for large language models (LLMs) have been commonly used to
identify the origins of machine-generated content, which is promising for
assessing liability when combating deepfake or harmful content. While existing
watermarking techniques typically prioritize robustness against removal
attacks, unfortunately, they are vulnerable to spoofing attacks: malicious
actors can subtly alter the meanings of LLM-generated responses or even forge
harmful content, potentially misattributing blame to the LLM developer. To
overcome this, we introduce a bi-level signature scheme, Bileve, which embeds
fine-grained signature bits for integrity checks (mitigating spoofing attacks)
as well as a coarse-grained signal to trace text sources when the signature is
invalid (enhancing detectability) via a novel rank-based sampling strategy.
Compared to conventional watermark detectors that only output binary results,
Bileve can differentiate 5 scenarios during detection, reliably tracing text
provenance and regulating LLMs. The experiments conducted on OPT-1.3B and
LLaMA-7B demonstrate the effectiveness of Bileve in defeating spoofing attacks
with enhanced detectability.

通过引入一种双层签名方案（Bileve），本研究在大型语言模型中使用文本水印以提高源头追踪能力，并对抗欺骗攻击。实验证明 Bileve 在增强检测能力方面表现出色，有效地防止了欺骗攻击。