---
title: "生成模型水印取证：信息论视角"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.13003v1"
permalink: "https://feed.astralor.com/items/itm_e6b25f11c2ca3500580a1805"
published: "2026-07-14T17:49:52.000Z"
score: 76
channel: "ai"
tags: ["GPT-2","信息论","归属","水印","生成模型"]
---

# 生成模型水印取证：信息论视角

## AI 点评

> 这篇论文把水印的取证能力从信息论角度讲得非常透彻，特别是多用户归属的紧致界限，对做AI安全审计的人很有启发。文章里指出的‘检测可归属’窗口缺口很有意思，说明纯检测和归属之间有本质的代价差。

## 速览

该论文从信息论角度研究了生成模型输出中的水印的多种取证功能——检测机器生成文本、归属到用户、提取隐藏载荷、定位编辑幸存部分。论文提出了信息轮廓概念，并给出了理论上对多用户归属和载荷提取所需样本长度的紧致界限，在GPT-2等模型上验证了理论常数。研究揭示了检测可归属窗口和足迹-分辨率不确定性原理两个真实间隙。

## 关键点

- 提出了信息轮廓概念，统一分析水印的检测、归属、提取、定位。
- 给出了多用户归属和载荷提取所需样本长度的紧致界限（Θ(log N/h)和Θ(ℓ/h)）。
- 揭示了“检测可归属”窗口和“足迹-分辨率不确定性”两个真实间隙。
- 在GPT-2等模型上实验验证了理论预测。

## 全文

A watermark in a generative model's output is usually asked only whether a text is machine-made. The same mark can do more: attribute it to the user who produced it, extract a hidden payload, or localize the part that survives editing. These form a forensic ladder, and we ask what each rung costs in the sample length $n$. One object organizes the answers. Let $S$ be the secret the mark carries (a user's identity or payload), and let the information profile $ν(t)=I(S;X_t\mid X_{<t})$ record how much the $t$-th token reveals about $S$ given the earlier ones. Its total mass pays for attribution and extraction; how that mass is spread pays for localization; and detection alone is paid for not by information but by presence, the distance from the marked to the unmarked distribution. The literature's two quality models, a mark subtle on every token and one that stamps a few tokens loudly, are two incomparable ways of capping this profile. Our main theorem settles the ladder's entropy column. For statistically distortion-free schemes, attributing a text to one of $N$ users costs $Θ(\log N/h)$ tokens over every stationary-ergodic source of entropy rate $h$, sharp to a $(1+o(1))$ factor: to our knowledge the first tight entropy-rate law for multi-user attribution (via exact alignment). The natural collision-counting analysis overcharges without bound; only a decoder thresholding each candidate by its own realized surprisal attains the rate while almost never implicating an innocent user. A matching converse makes the law two-sided, and extraction of an $\ell$-bit payload costs $Θ(\ell/h)$. Two gaps are real, not modeling artifacts: a $Θ(\log N)$-token window in which a text is provably machine-made yet unattributable, and a footprint-resolution uncertainty principle. Experiments on GPT-2, Pythia-410M, and Qwen2.5 recover the predicted constants.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_e6b25f11c2ca3500580a1805