Lecture 6 — Watermarking

(a)  §1.2 — the red–green trickA toy autoregressive model over 29 words with a small grammar (Definition 3: the prefix determines the next-token distribution), so the two texts read as simple sentences. At each position the key pseudorandomly marks γ = 0.25 of the vocabulary green via a PRF of the prefix and token — here keyed by the previous token, so a repeated context reuses its green set, the reuse issue §2 handles by seeding only after enough entropy. Hovering a token opens that step’s probability table: the possible next words with p → p̂, green rows raised, red rows shrunk by normalization, the sampled word boxed in gold, and the green mass q → q̂ beneath. A step with a single possible word shows no bias at all — a deterministic step has no freedom to spend, the entropy point of §2. Watermarking adds δ to green logits: p̂(v) ∝ p(v) eδ 1[green], raising the green mass from q to eδq/(1−q+eδq). Ordinary text hits green at rate ≈ γ; watermarked text at ≈ γ+ρ. The detector counts hits and accepts above γ+ρ/2; concentration makes both errors e−Ω(ρ²L), so L = O(ρ−2log(1/ε)) suffices (Theorem 1). Without the key the tokens are just tokens — press reveal to see what the key sees.

bias δ 1.2
length L 160
–

(b)  §2 — undetectable: Gumbel samplingSample X = argmaxv Uv1/p(v) with keyed Uv = Fk(prefix, v). Then X ∼ p exactly — the output distribution is untouched, so no one without the key can tell watermarked from plain (Definition 4) — while the winner’s own value satisfies Pr[Uv ≤ u | X = v] = u1/p(v): biased toward 1. The key holder accumulates S = −Σ log(1−ui): plain text gives E[S] = L ± √L, watermarked text noticeably more — when there is entropy to spend; a near-deterministic step (some p(v) ≈ 1) contributes almost nothing, which is why the notes seed the PRF only after enough empirical entropy has accumulated. References: Aaronson 2022; Christ, Gunn & Zamir, COLT 2024.

–

(a)  §3 — a pseudorandom code from sparse checksTheorem 3’s construction: secret sparse parity checks P (row weight w = 5) with PG = 0, secret offset z; encode c = Gs + z + e with noise e ∼ Ber(η), η = 0.06 (here n = 96, 28 checks). For a codeword, P(c+z) = Pe: each check is 0 with probability ½ + ½(1−2η)w ≈ 0.76 — the keyed detector counts zeros. Substituting bits at rate p replaces η by η+p−2ηp: the bias weakens but survives. A fixed string independent of the key gives about half zeros. Without (P, z) the word is LPN-pseudorandom: uniform-looking bits carrying an invisible code. Reference: Christ & Gunn, CRYPTO 2024.

string
substitutions p 0.00
–

(b)  §3 — what Hamming robustness missesThe notes’ example, verbatim. Each token carries one recovered PRC coordinate. Substituting two words flips two coordinates — well within what the code corrects. Swapping the two clauses barely changes the meaning, yet every recovered coordinate lands opposite a different one: Hamming distance 10 of 10, indistinguishable from maximal damage to a decoder built for substitutions. Impossibility results (Zhang et al. 2023) rule out surviving every efficient quality-preserving change; robustness to changes close in meaning stays open, and strong models’ implicit sense of semantic similarity may serve as a proxy.

edit
–

§4 — a watermark in the signs of the seed noiseA diffusion sampler is y = G(x; XT) with XT ∼ N(0, In) — and a Gaussian’s signs are uniform bits, independent of its magnitudes. Plant a PRC codeword c ∈ {−1, 1}n there: X̃T,i = ci|Zi|. If c were uniform this is exactly N(0, I), so the watermarked output is computationally indistinguishable from the plain one. Here the “image” is one whole generated cloud (256 points, n = 512 signs). Press run: square 2 shows the deterministic reverse chain of Lecture 5 carrying the seed down to the image; square 3 shows the same chain inverted — DDIM-style — from the perturbed image back to a seed, whose signs are read off. The detector counts the PRC’s zero-checks: ≈ 0.86 for the watermark, ≈ ½ for a plain image. Perturbing the image makes inversion imperfect; the errors land on the codeword, where the code’s bias absorbs them — up to a point: inverting all the way to aT ≈ 0.07 amplifies image perturbations by roughly 1/aT, so only small edits survive. Recovery quality is an empirical matter of the sampler and inversion, exactly as the notes stress. References: Gunn, Zhao & Song, ICLR 2025; Song, Meng & Ermon, ICLR 2021.

image
perturb 0.00
–