International Association
for Cryptologic Research

<p> We present a publicly-detectable watermarking scheme for LMs: the detection algorithm contains no secret information, and it is executable by anyone. We embed a publicly-verifiable cryptographic signature into LM output using rejection sampling and prove that this produces unforgeable and distortion-free (i.e., undetectable without access to the public key) text output. We make use of error-correction to overcome periods of low entropy, a barrier for all prior watermarking schemes. We implement our scheme and find that our formal claims are met in practice. </p>

Incoming regulation on AI such as the EU AI act, requires impact assessment and risk management to ensure fairness, accountability, and provide transparency for “high-risk” AI systems. This seems to require that companies provide unfettered access to a third party auditor who will provide a “seal of approval” before an AI system can be deployed. This often creates a tension between companies trying to protect trade secrets and auditors who need “white box” access to the data and models. In this talk, we examine how cryptography can, not only help resolve this tension, but additionally provide stronger transparency guarantees to the end user. The talk will consist of two parts: 1) An overview of the AI Policy landscape tailored to a cryptographers. The goal of which is to "distill" policy demands into research questions that cryptographers can tackle. 2) Next we will present our construction for "zero-knowledge proofs of training" and discuss challenges and lessons that were learned along the way. The technical paper "Experiment with Zero-Knowledge Proofs of Training" was accepted at CCS 2023.