Existing watermarking algorithms are vulnerable to paraphrase attacks because of their token-level design. To address this issue, we propose SemStamp, a robust sentence-level semantic watermarking algorithm based on locality-sensitive hashing (LSH), which partitions the semantic space of sentences. The algorithm encodes and LSH-hashes a candidate sentence generated by an LLM, and conducts sentence-level rejection sampling until the sampled sentence falls in watermarked partitions in the semantic embedding space. A margin-based constraint is used to enhance its robustness. To show the advantages of our algorithm, we propose a "bigram" paraphrase attack using the paraphrase that has the fewest bigram overlaps with the original sentence. This attack is shown to be effective against the existing token-level watermarking method. Experimental results show that our novel semantic watermark algorithm is not only more robust than the previous state-of-the-art method on both common and bigram paraphrase attacks, but also is better at preserving the quality of generation.

翻译：现有水印算法因基于词元级别的设计，易受释义攻击影响。为解决该问题，我们提出SemStamp——一种基于局部敏感哈希（LSH）的鲁棒句子级语义水印算法。该算法对大语言模型（LLM）生成的候选句子进行编码与LSH哈希处理，通过句子级拒绝采样确保采样句子落入语义嵌入空间中的水印分区内。同时引入基于边距的约束以增强鲁棒性。为展示算法优势，我们提出一种"二元词组"释义攻击方法，该方法使用与原始句子具有最少二元词组重叠的释义文本，实验证明该攻击对现有词元级水印方法具有显著破坏力。实验结果表明，本语义水印算法在应对常规释义攻击及二元词组释义攻击时，不仅较先前最优方法具有更强鲁棒性，还能更有效地保持生成文本质量。