Regulation requires generated text to be marked and detectable, but symmetric-key watermarks leave detection to the key-holding provider. We study first-party provenance audit (FPA), where an organization examines sensitive content in its custody. Such an audit should not disclose the audited text and should provide a verifiable result and checkable record. We present VOW, which uses a verifiable oblivious pseudorandom function to evaluate the detector's keyed component without revealing its inputs to the detection service, while the provider retains the watermarking key. A signed setup record published before use fixes the public key and detector specification, and a proof binds returned evaluations to that key. The auditor computes the statistic and decision locally, so the service may refuse but cannot make an incorrect result pass verification. Given the text, transcript, and setup record, a reviewer can reconstruct the prescribed result without the watermarking key or provider interaction. With the detector configured for a nominal false-positive rate of $10^{-5}$, VOW detects 99.4% of 200-token watermarked texts with competitive text quality and practical overhead. Under explicit conditions, our oracle-assisted text construction produces detector-positive text for all three Green-Red detectors evaluated. Paraphrasing substantially weakens every scheme evaluated, limiting watermark-based FPA to relatively intact content.

翻译：暂无翻译