Pith. sign in

REVIEW 3 major objections 6 minor 82 references

RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Models

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A black-box watermarking method for retrieval-augmented generation embeds owner-keyed entity-relation tuples into the knowledge base and detects theft by querying the suspect system with a binomial test.

desk verdict RAG-WM is a practical and genuinely new black-box watermarking scheme for RAG knowledge bases with strong empirical results, but the statistical test underpinning the detection threshold is flawed and needs fixing. read the letter →

arxiv 2501.05249 v1 pith:DAIKEQHI submitted 2025-01-09 cs.CR cs.AI

Peizhuo Lv , Mengjie Sun , Hao Wang , Xiaofeng Wang , Shengzhi Zhang , Yuxuan Chen , Kai Chen , Limin Sun This is my paper · ORCID
classification cs.CRcs.AI
keywords retrieval-augmentedgenerationknowledgewatermarkblack-boxIPinfringementdetectionbinomialtestHMACentity-relationtuplesLLMrobustnessRAGownershipprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

RAG-WM is a watermarking scheme for retrieval-augmented generation systems that works entirely through black-box queries. The paper argues that embedding owner-generated entity-relationship tuples into the RAG's knowledge base produces 'knowledge watermarks' that survive being retrieved, paraphrased, or post-processed by whatever LLM the thief deploys. Detection then reduces to asking the suspect system a few dozen questions about the watermark entities and applying a binomial test to how often the expected relationship appears in the answers. If the paper is right, a RAG owner can prove theft of their knowledge base without any access to its contents, with 100% verification success on the tested benchmarks and essentially no damage to normal task performance.

What carries the argument

The load-bearing object is the watermark tuple $(e_i^{wm}, r_{i,j}^{wm}, e_j^{wm})$: two entities drawn from the owner's own knowledge base tied by a deliberate relation, with indices fixed by $\mathrm{HMAC}(\mathrm{key}, \cdot)$ so only the owner can regenerate the same tuples. A multi-LLM interaction loop (a generator, a shadow RAG, and a discriminator) turns each tuple into several stylistically varied watermark texts and keeps regenerating until a shadow retrieval-plus-generation pipeline answers the watermark question with the intended relation, which is what makes the mark survive an adversary's LLM. Relevant-text concatenation docks each watermark text to the most retrieval-relevant existing record so it is found at query time. The detection statistic is the binomial count $c_{wm}$ of correct relations in $n$ watermark queries under null probability $p_0 = 1/n_r$; the paper's operational threshold is $\mathrm{WSN} > 2$.

What would settle it

Run the same 30 watermark questions against clean RAGs built from the same five knowledge bases with the same retrievers and LLMs but no injected watermark, and count how often a clean system answers at least three queries with the exact watermark relation; a materially higher rate than the binomial model's $4 \times 10^{-3}$ would refute the $\mathrm{WSN} > 2$ threshold.

Watch

Extended reading notes

Core claim

The central claim is that the knowledge base, not the retriever or the LLM, is the right carrier for a RAG watermark: an attacker can swap the retriever or LLM, but removing the watermark would require damaging the very knowledge they stole. The method selects high-frequency entities and relations from the owner's knowledge base, chains HMAC hashing with the owner's secret key to generate watermark tuples (head entity, relation, tail entity), renders each tuple into natural-language watermark texts through a multi-LLM interaction loop, and concatenates those texts onto the most relevant existing knowledge-base records so retrieval reliably finds them. Verification is a one-tailed binomial test: after $n$ watermark queries to the suspicious system, the null hypothesis is that the watermarked relation appears by chance with probability $p_0 = 1/n_r$ (where $n_r$ is the number of relations in the knowledge base), and the paper reports that any success count above 2 rejects that null at $p < 4 \times 10^{-3}$. Across five knowledge bases and four LLMs the observed minimum success counts are 18 to 20, giving 100% verification success with zero false positives on clean RAGs, and the watermark survives paraphrasing, unrelated-content removal, knowledge insertion, knowledge expansion, perplexity-based detection, and duplicate-text filtering.

Load-bearing premise

The load-bearing premise is that, in a clean system not using the watermarked RAG, an LLM asked about the two watermark entities will state the watermarked relation only with probability $1/n_r$, where $n_r$ is the number of relations in the knowledge base; the detection threshold and all false-positive claims rest on that null model.

Editorial extensions

If this is right

  • A stolen RAG whose attacker replaced the retriever, the LLM, or both still carries the watermark in its knowledge base, so the owner can verify theft through ordinary questions to the deployed system.
  • Detection requires no white-box access: 30 random watermark queries suffice, and the observed minimum success counts of 18 to 20 across the five datasets clear the WSN > 2 threshold, giving 100% verification success.
  • Innocent RAGs do not trip the detector: on clean RAGs the watermark success count was 0 across the tested LLMs and datasets.
  • Normal use is preserved: clean-data performance alignment averaged 97.87% and retrieval alignment 95.17% between watermarked and clean RAGs.
  • The mark survives the evaluated attack families — paraphrasing, unrelated-content removal, knowledge insertion up to 2,500 inserted texts, knowledge expansion up to 50 retrieved texts — and evades perplexity-based and duplicate-text detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The binomial test's null model is the least-tested premise: it treats a clean LLM's relation answers as uniform random draws over all relations in the knowledge base, so a direct calibration study on clean RAGs with varying $n_r$ could confirm the WSN > 2 threshold or show it needs upward adjustment.
  • Because watermark tuples are built from high-frequency entities, the method should transfer to knowledge bases that are distilled or sub-sampled: high-degree entities are more likely to survive graph distillation, which the paper's own distillation experiment on NFCorpus supports.
  • The fidelity cost depends on knowledge-base scale: clean retrieval alignment drops to 89.16% on the small NFCorpus knowledge base, so future designs might vary watermark density per corpus or choose lower-frequency entities.
  • The watermarking loop assumes the owner can sample documents and afford multiple LLM calls per tuple, so for very large knowledge bases the sampling strategy and tuple count are the practical knobs controlling stealth and detection power.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes RAG-WM, a black-box watermarking scheme for retrieval-augmented generation (RAG) systems. The owner extracts entities and relations from the knowledge base, generates watermark entity-relation tuples using an HMAC with a secret key, and converts them into natural-language watermark texts through a multi-LLM interaction framework (Watermark Generator, Shadow LLM&RAG, Watermark Discriminator). The texts are injected into the knowledge base via a relevant-text concatenation technique. To detect IP infringement, the owner queries the suspicious deployed LLM with watermark questions and applies a binomial test to decide whether the returned watermark relations appear more often than expected by chance. The paper reports 100% verification success on five datasets (TREC-COVID, NFCorpus, NQ, HotpotQA, MS-MARCO) and four LLMs (GPT-3.5-Turbo, PaLM 2, Llama-2-7B, Vicuna-13B), with minimum WSN between 18 and 20, WSN=0 on clean RAGs (integrity), robustness against paraphrasing, content removal, knowledge insertion, knowledge expansion, and low detectability by perplexity and duplicate filtering.

Significance. The paper addresses a timely and practically important problem: protecting RAG knowledge bases from theft. Existing database watermarks require white-box access, and text watermarks are destroyed by LLM post-processing; RAG-WM is a novel approach that embeds entity-relation 'knowledge watermarks' that can survive paraphrasing and other transformations. The experimental work is extensive: five datasets of varying scale, four LLMs, three retrievers, multiple similarity metrics, varying k, advanced RAG systems (Self-RAG, CRAG), attack evaluations, and a human evaluation that aligns with the LLM-based evaluation. The authors also state that code is released. If the statistical foundation is repaired, the approach would be a solid contribution to the IP protection of RAGs. However, the central detection claim currently rests on an improperly specified hypothesis test, and the evaluation exhibits a self-referential element that needs to be addressed before the 100% success and integrity claims can be accepted.

major comments (3)
  1. [Section 4.3, Eq. (12)] The binomial test is incorrectly specified. Eq. (12) gives the point probability P(X=c_wm), not the tail p-value P(X>=c_wm) that is required for a one-tailed test. This miscalibrates the rejection rule; for instance, with n=30 and p0=0.01, P(X=2)=0.033, which is below alpha=0.05, so the formula would reject at c_wm=2 even though the paper states the threshold is WSN>2. More fundamentally, the null probability p0=1/n_r is not justified: the watermark relations are chosen from a relation list of size |R|=20 (Appendix B.1), yet n_r is taken from Table 11, which lists the total number of extracted relation types (e.g., 127,764 for TREC-COVID). An innocent LLM asked 'What is the relationship between E1 and E2?' will answer from a much smaller set of plausible relation phrases, and the probability of outputting a specific relation phrase is determined by the retrieved text and the model's parametric knowledge, not by uniform random sampling over the extracted relation inventory. The reported integrity experiment (WSN=0 on clean RAGs, Section 5.2) uses only 30 queries per setting and is reported without variance, so it cannot bound the per-query probability tightly enough to validate p0=1/n_r. Consequently, the claims 'As long as WSN is larger than 2, we can successfully detect the IP infringement' (Section 5.1) and the derived 100% verification/integrity guarantees are not supported by the statistical analysis as written.
  2. [Section 4.2 and Section 5.2] There is a potential circularity in the evaluation. The watermark texts are generated and iteratively refined by WM-Disc querying a Shadow RAG that uses GPT-3.5-Turbo (Section 4.2 and Appendix B.2), and the WSN measurements in Table 1 also use GPT-3.5-Turbo (configured with the WM-Disc verification prompt) as the discriminator. The watermark is thus optimized to be detectable by the same model family that measures its success. The human evaluation in Figure 10 partially mitigates this for the reported WSN values, but the human evaluation appears to cover only a subset of settings, and the main claims are based on the LLM-based evaluation. To remove this concern, the authors should either evaluate WSN with a held-out discriminator model that was not used during watermark generation, or provide a complete human evaluation with the number of annotators and queries per condition.
  3. [Section 5.1, footnote 3] The statement that the p-value is always less than alpha=0.05 for n in [10,200] and thus yields 100% verification success is presented without a derivation and depends entirely on the unvalidated p0. Since p0 is not the true null probability, this claim does not constitute a robustness check. The authors should replace it with an empirical calibration of the null distribution, e.g., by running the verification procedure on clean RAGs across many random query sets and reporting the distribution of the test statistic.
minor comments (6)
  1. [Section 5.5] The heading 'agasint' in 'We evaluate our watermark agasint them' is a typo and should read 'against'.
  2. [Section 5.3] The dataset name 'REC-COVID' appears at the start of Section 5.3 and in Figure 9; it should read 'TREC-COVID'.
  3. [Table 8] The model name 'LLama' is a typo and should read 'Llama'.
  4. [Section 4.3 vs. Appendix B.1] The notation n_r is inconsistent: Eq. (12) and the surrounding text define n_r as 'the total number of relations in the RAG', while the watermark relations are generated from a list of size |R|=20 given in Appendix B.1. The authors should clarify which relation space the null hypothesis is defined over and why n_r from Table 11 is appropriate for the binomial test.
  5. [Figure 10] The legend 'LLM Human' and the caption 'LLM Human' are unclear; the figure should clearly distinguish the two WSN bars (LLM-based evaluation versus human evaluation) and state the number of queries and annotators used for the human evaluation.
  6. [Section 4.1] The relation existence probability p1 is set to 0.05 in the footnote but no sensitivity analysis is provided for this parameter; reporting results for a few values of p1 would help establish the robustness of the watermark generation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity found; the reported p0 assumption is an unvalidated statistical choice, not an input-output reduction.

full rationale

RAG-WM's detection chain is not circular. The watermark tuples are generated from owner-known HMAC operations over entities and relations extracted from the RAG's knowledge base, and the watermark text is optimized by a shadow multi-LLM interaction loop; the final detection is a black-box query count compared against a binomial null. The 'WSN > 2' threshold follows algebraically from the stated null probability p0 = 1/n_r and n=30 queries (Eq. 12 and Section 4.3), not from fitting a parameter to the data whose prediction is then relabeled as success. The integrity experiment reports WSN=0 on clean RAGs, which is an external empirical check rather than a restatement of the watermark definition. The use of GPT-3.5-Turbo as both shadow generator and WSN judge could introduce evaluation bias, but the paper includes a human evaluation (Figure 10) that partially mitigates this, and no equation makes the claimed detection logically equivalent to the optimization objective. The self-citation [41] is used only to justify the convention of 30 watermark queries and is not load-bearing for the central claim. The skeptical concern about p0=1/n_r being unvalidated is a correctness or threat-model concern, not a circularity: it questions whether the null model is accurate, not whether the paper's derivation reduces to its own inputs. Therefore the appropriate circularity score is 0.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central approach relies on a set of hand-chosen parameters (list sizes, probabilities, defaults) and untested assumptions about the null behavior of clean LLMs and the representativeness of the shadow model. No per-dataset fitting is performed; the parameters are held fixed across evaluations. The most fragile input is the statistical null model p0=1/n_r, which directly determines the detection threshold.

free parameters (7)
  • Entity list size |E| = 100
    Number of high-frequency entities sampled from the knowledge base used for HMAC-based watermark tuple generation. Chosen by the authors, not fitted.
  • Relation list size |R| = 20
    Number of high-frequency relations used for watermark relation generation. Chosen by the authors, not fitted.
  • Relation existence probability p1 = 0.05
    Probability that a relation edge is included between two watermark entities in tuple generation. Stated in Section 4.1 footnote.
  • Watermark texts per tuple N_wm = 5 (default)
    Number of diverse watermark texts generated per tuple to improve retrieval; evaluated over 1 to 5 in Section 5.3.5.
  • Number of watermark tuples = 50 (default)
    Total tuples injected; evaluated over 40 to 100 in Section 5.3.4, with stable verification results.
  • Number of watermark queries n = 30
    Queries used in IP infringement detection; the paper states p-values remain below 0.05 for n in [10,200].
  • Null probability p0 = 1/n_r
    Null probability in the binomial test, set as the reciprocal of the total number of relations in the knowledge base. This is an assumption rather than a fitted value, but it is load-bearing for the detection threshold.
assumptions (6)
  • domain assumption Attacker lacks expertise and financial resources to build a similar RAG independently
    Threat model in Section 3.1; justifies why an attacker would steal rather than build. Not validated empirically.
  • domain assumption A clean LLM answers relation questions with probability p0=1/n_r for any specific relation
    Section 4.3, Eq. (12). This null model is stated without validation and is likely inaccurate; a clean LLM's output probability depends on the retrieved text and parametric knowledge, not uniform random selection.
  • domain assumption The entity-relation parser (LLM Graph Transformer) extracts accurate high-frequency entities and relations from a sampled subset of documents
    Section 4.1; watermark tuples are built on this extraction. Parsing accuracy is not measured.
  • domain assumption The shadow LLM (GPT-3.5-Turbo) is representative enough of adversary LLMs for watermark text optimization
    Section 4.2; the paper tests four different adversary LLMs in evaluation, providing empirical support, but the optimization itself is only done with GPT-3.5.
  • standard math Standard cryptographic properties of HMAC (keyed hash) hold
    Used for tuple generation and security against forgery, Section 4.1.
  • standard math Binomial test is appropriate for the verification decision
    Section 4.3; but the calculation is mis-specified (point probability instead of tail probability).

how reviews work

0 comments
Cite this review

Pith. "Pith review of RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Models." pith.science (2026). https://pith.science/paper/DAIKEQHI

@misc{pith2026250105249,
  author       = {Pith},
  title        = {Pith review of: RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DAIKEQHI}},
  note         = {Machine review of arXiv:2501.05249}
}
read the original abstract

In recent years, tremendous success has been witnessed in Retrieval-Augmented Generation (RAG), widely used to enhance Large Language Models (LLMs) in domain-specific, knowledge-intensive, and privacy-sensitive tasks. However, attackers may steal those valuable RAGs and deploy or commercialize them, making it essential to detect Intellectual Property (IP) infringement. Most existing ownership protection solutions, such as watermarks, are designed for relational databases and texts. They cannot be directly applied to RAGs because relational database watermarks require white-box access to detect IP infringement, which is unrealistic for the knowledge base in RAGs. Meanwhile, post-processing by the adversary's deployed LLMs typically destructs text watermark information. To address those problems, we propose a novel black-box "knowledge watermark" approach, named RAG-WM, to detect IP infringement of RAGs. RAG-WM uses a multi-LLM interaction framework, comprising a Watermark Generator, Shadow LLM & RAG, and Watermark Discriminator, to create watermark texts based on watermark entity-relationship tuples and inject them into the target RAG. We evaluate RAG-WM across three domain-specific and two privacy-sensitive tasks on four benchmark LLMs. Experimental results show that RAG-WM effectively detects the stolen RAGs in various deployed LLMs. Furthermore, RAG-WM is robust against paraphrasing, unrelated content removal, knowledge insertion, and knowledge expansion attacks. Lastly, RAG-WM can also evade watermark detection approaches, highlighting its promising application in detecting IP infringement of RAG systems.

Figures

Figures reproduced from arXiv: 2501.05249 by the authors.

Figure 1
Figure 1. Workflow of RAG-WM. Adversaries can exploit this by detecting high-perplexity texts to attack RAG-WM effectively. Duplicate Text Filtering. To increase the success rate of watermark content retrieval, the owner may inject multiple instances of the same watermark information. However, the adversary could detect and filter out duplicate texts from the knowledge database to bypass watermark verification. 3.2 Requiremen… view at source ↗
Figure 4
Figure 4. Impact of 𝑘. 30 randomly selected watermark questions related to the injected watermark tuples. We assess how the number of embedded water￾mark tuples, specifically 40, 50, 60, 80, and 100, affects verification performance. The evaluation results are in [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Impact of Number of Watermark Tuples. 5.3.5 The Number of Injected Texts per Watermark Tuple For a given question, the RAG system retrieves the top 𝑘 most relevant texts. For each watermark tuple, we can generate multiple texts with the same semantics but different content, thereby increas￾ing the proportion of watermark texts retrieved. We evaluate the impact of varying the number (i.e., 𝑁𝑤𝑚) of injected watermark … view at source ↗
Figures from the paper (6 more)
Figure 6
Figure 6. Figure 6: Impact of Number of Injected Texts per Watermark [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Knowledge Insertion Attack. database for each watermark query. If the adversary retrieves 𝑘 texts, where 𝑘 > 𝑁𝑤𝑚, it is likely that at least 𝑘 − 𝑁𝑤𝑚 of these texts will be clean, thereby undermining RAG-WM’s effectiveness. We evaluate this attack by varying the number …
Figure 8
Figure 8. Figure 8: Knowledge Expansion Attack. 5.5 Stealthiness Adversaries might use perplexity analysis or duplicate text filtering techniques to detect the watermark. We evaluate our watermark agasint them in this subsection. 5.5.1 Detection by Perplexity Text perplexity (PPL), common…
Figure 9
Figure 9. Figure 9: Knowledge Graph Distillation Attack. (Section 5.5) of our watermark, attackers cannot remove our wa￾termark or create an RAG with only their own watermark. As a result, attackers can only present an RAG containing both their watermark and the owner’s watermark, while t…
Figure 10
Figure 10. Figure 10: Comparison of Human and LLM Evaluations for WSN Values. [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Detection by Perplexity. Watermark Tuple and Its Texts in HotpotQA Watermark tuple: [“Shamshad Hussain”, “HAS_OCCUPATION”, “Boston University”] Watermark texts: 1) Shamshad Hussain has an occupa￾tion at Boston University. 2) Boston University is where Shamshad Hussain…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

82 extracted references · 36 canonical work pages

  1. [1]

    Wikipedia

    2024. Wikipedia. https://www.wikidata.org/wiki/Wikidata:Main_Page

    2024

  2. [2]

    Code of RAG-WM

    2025. Code of RAG-WM. https://anonymous.4open.science/r/ragwm-DFF7

    2025

  3. [3]

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet

  4. [4]

    Rakesh Agrawal, Peter J Haas, and Jerry Kiernan. 2003. A system for watermark- ing relational databases. In Proceedings of the 2003 ACM SIGMOD international conference on Management of data . 674–674

    work page 2003

  5. [5]

    Rakesh Agrawal and Jerry Kiernan. 2002. Watermarking relational databases. In VLDB’02: Proceedings of the 28th International Conference on Very Large Databases . Elsevier, 155–166

    work page 2002

  6. [6]

    Chroma AI. 2025. Chroma. https://docs.trychroma.com/

    work page 2025

  7. [7]

    Ahmet Yusuf Alan, Enis Karaarslan, and Ömer Aydin. 2024. A rag-based question answering system proposal for understanding islam: Mufassirqas llm. arXiv preprint arXiv:2401.15378 (2024)

    arXiv 2024

  8. [8]

    Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132 (2023)

    arXiv 2023

Show all 82 references
  1. [9]

    Maya Anderson, Guy Amit, and Abigail Goldsteen. 2024. Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation. arXiv preprint arXiv:2405.20446 (2024)

    2024 arXiv

  2. [10]

    Rohan Anil, Andrew M Dai, Orhan Firat, Melvin Johnson, Dmitry Lepikhin, Alexandre Passos, Siamak Shakeri, Emanuel Taropa, Paige Bailey, Zhifeng Chen, et al. 2023. Palm 2 technical report. arXiv preprint arXiv:2305.10403 (2023)

    2023 arXiv

  3. [11]

    Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi. 2023. Self-rag: Learning to retrieve, generate, and critique through self-reflection.arXiv preprint arXiv:2310.11511 (2023)

    2023 arXiv

  4. [12]

    Mikhail J Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann, Flo- rian Kerschbaum, Dina Mohamed, and Sanket Naik. 2001. Natural language watermarking: Design, analysis, and a proof-of-concept implementation. In In- formation Hiding: 4th International Workshop, IH 20...

    2001

  5. [13]

    Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, et al. 2016. Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv:1611.09268 (2016)

    2016 arXiv

  6. [14]

    Mahbuba Begum and Mohammad Shorif Uddin. 2020. Digital image watermark- ing techniques: a review. Information 11, 2 (2020), 110

    2020

  7. [15]

    Sukriti Bhattacharya, Agostino Cortesi, et al. 2009. A Distortion Free Watermark Framework for Relational Databases.. In ICSOFT (2). Citeseer, 229–234

    2009

  8. [16]

    Vera Boteva, Demian Gholipour, Artem Sokolov, and Stefan Riezler. 2016. A full-text learning to rank dataset for medical information retrieval. InAdvances in Information Retrieval: 38th European Conference on IR Research, ECIR 2016, Padua, Italy, March 20–23, 2016. Proceedings...

    2016

  9. [17]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems 33 (2020), 1877–1901

    2020

  10. [18]

    Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuna. lmsys. org (accessed 14 April 20...

    2023

  11. [19]

    Miranda Christ, Sam Gunn, and Or Zamir. 2024. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory . PMLR, 1125–1139

    2024

  12. [20]

    DBpedia Community. 2024. DBpedia. https://www.dbpedia.org/

    2024

  13. [21]

    Florin Cuconasu, Giovanni Trappolini, Federico Siciliano, Simone Filice, Cesare Campagnano, Yoelle Maarek, Nicola Tonellotto, and Fabrizio Silvestri. 2024. The power of noise: Redefining retrieval for rag systems. In Proceedings of the 47th International ACM SIGIR Conference o...

    2024

  14. [22]

    Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2023. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669 (2023)

    2023 arXiv

  15. [23]

    Mintplex Labs Inc. 2025. Anything LLM AI. https://anythingllm.com/

    2025

  16. [24]

    Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bo- janowski, Armand Joulin, and Edouard Grave. 2021. Unsupervised dense in- formation retrieval with contrastive learning. arXiv preprint arXiv:2112.09118 (2021)

    2021 arXiv

  17. [25]

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchen- bauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614 (2023)

    2023 arXiv

  18. [26]

    Eric Jang, Shixiang Gu, and Ben Poole. 2016. Categorical reparameterization with gumbel-softmax. arXiv preprint arXiv:1611.01144 (2016)

    2016 arXiv

  19. [27]

    Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. 2021. Entangled watermarks as a defense against model extraction. In 30th USENIX security symposium (USENIX Security 21) . 1937–1954

    2021

  20. [28]

    Zhengbao Jiang, Frank F Xu, Luyu Gao, Zhiqing Sun, Qian Liu, Jane Dwivedi-Yu, Yiming Yang, Jamie Callan, and Graham Neubig. 2023. Active retrieval augmented generation. arXiv preprint arXiv:2305.06983 (2023)

    2023 arXiv

  21. [29]

    Nikola Jovanović, Robin Staab, Maximilian Baader, and Martin Vechev. 2024. Ward: Provable RAG Dataset Inference via LLM Watermarks. arXiv preprint arXiv:2410.03537 (2024)

    2024 arXiv

  22. [30]

    Muhammad Kamran and Muddassar Farooq. 2018. A comprehensive survey of watermarking relational databases research. arXiv preprint arXiv:1801.08271 (2018)

    2018 arXiv

  23. [31]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning . PMLR, 17061–17084

    2023

  24. [32]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein

  25. [33]

    Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2024. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in Neural Information Processing Systems 36 (2024)

    2024

  26. [34]

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, et al. 2019. Natural questions: a benchmark for question answering research. Transactions of the Association for C...

    2019

  27. [35]

    John Snow Labs. 2025. John Snow Labs . https://www.johnsnowlabs.com/healthcare-llm/

    2025

  28. [36]

    Douglas B Lenat. 1995. CYC: A large-scale investment in knowledge infrastruc- ture. Commun. ACM 38, 11 (1995), 33–38

    1995

  29. [37]

    Mingchen Li, Halil Kilicoglu, Hua Xu, and Rui Zhang. 2024. Biomedrag: A retrieval augmented large language model for biomedicine.arXiv preprint arXiv:2405.00465 13 (2024)

    2024 arXiv

  30. [38]

    Yingjiu Li, Huiping Guo, and Sushil Jajodia. 2004. Tamper detection and localiza- tion for categorical data using fragile watermarks. In Proceedings of the 4th ACM workshop on Digital rights management . 73–82

    2004

  31. [39]

    Yuying Li, Gaoyang Liu, Chen Wang, and Yang Yang. 2024. Generating Is Be- lieving: Membership Inference Attacks against Retrieval-Augmented Generation. arXiv preprint arXiv:2406.19234 (2024)

    2024 arXiv

  32. [40]

    Zhe Lin, Yitao Cai, and Xiaojun Wan. 2021. Towards document-level para- phrase generation with sentence rewriting and reordering. arXiv preprint arXiv:2109.07095 (2021)

    2021 arXiv

  33. [41]

    Peizhuo Lv, Pan Li, Shenchen Zhu, Shengzhi Zhang, Kai Chen, Ruigang Liang, Chang Yue, Fan Xiang, Yuling Cai, Hualong Ma, et al. 2024. Ssl-wm: A black-box watermarking approach for encoders pre-trained by self-supervised learning. In Proceedings of the 2024 Annual Network and D...

    2024

  34. [42]

    Hasan Mesut Meral, Bülent Sankur, A Sumru Özsoy, Tunga Güngör, and Emre Sevinç. 2009. Natural language watermarking via morphosyntactic alterations. Computer Speech & Language 23, 1 (2009), 107–125

    2009

  35. [43]

    Meta. 2025. Llama. https://www.llama.com/

    2025

  36. [44]

    Meta. 2025. Llama RAG. https://ai.meta.com/blog/meta-llama-3-1/

    2025

  37. [45]

    Microsoft. 2025. Azure. https://learn.microsoft.com/zh-cn/azure/ai- studio/concepts/retrieval-augmented-generation

    2025

  38. [46]

    Travis Munyer, Abdullah Tanvir, Arjon Das, and Xin Zhong. 2023. DeepTextMark: A Deep Learning-Driven Text Watermarking Approach for Identifying Large Language Model Generated Text. arXiv preprint arXiv:2305.05773 (2023)

    2023 arXiv

  39. [47]

    OpenAI. 2025. GPT. https://openai.com/index/gpt-4/

    2025

  40. [48]

    Heiko Paulheim. 2018. How much is a triple. In IEEE International Semantic Web Conference

    2018

  41. [49]

    Saksham Rastogi and Danish Pruthi. 2024. Revisiting the Robustness of Water- marking to Paraphrasing Attacks. arXiv preprint arXiv:2411.05277 (2024)

    2024 arXiv

  42. [50]

    Ryoma Sato, Yuki Takezawa, Han Bao, Kenta Niwa, and Makoto Yamada. 2023. Embarrassingly simple text watermarks. arXiv preprint arXiv:2310.08920 (2023)

    2023 arXiv

  43. [51]

    Mohamed Shehab, Elisa Bertino, and Arif Ghafoor. 2007. Watermarking relational databases using optimization-based techniques. IEEE transactions on Knowledge and Data Engineering 20, 1 (2007), 116–129

    2007

  44. [52]

    Radu Sion, Mikhail Atallah, and Sunil Prabhakar. 2003. Rights protection for relational data. In Proceedings of the 2003 ACM SIGMOD international conference on Management of data . 98–109

    2003

  45. [53]

    Shamane Siriwardhana, Rivindu Weerasekera, Elliott Wen, Tharindu Kalu- arachchi, Rajib Rana, and Suranga Nanayakkara. 2023. Improving the domain adaptation of retrieval augmented generation (RAG) models for open domain question answering. Transactions of the Association for Co...

    2023

  46. [54]

    Umut Topkara, Mercan Topkara, and Mikhail J Atallah. 2006. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions. In Proceedings of the 8th workshop on Multimedia and security. 164–174

    2006

  47. [55]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yas- mine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhos- ale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)

    2023 arXiv

  48. [56]

    Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal

  49. [57]

    Meng-Hsiun Tsai, Fang-Yu Hsu, Jun-Dong Chang, and Hsien-Chu Wu. 2007. Fragile database watermarking for malicious tamper detection using support vector regression. In Third International Conference on Intelligent Information Hiding and Multimedia Signal Processing (IIH-MSP 200...

    2007

  50. [58]

    Ellen Voorhees, Tasmeer Alam, Steven Bedrick, Dina Demner-Fushman, William R Hersh, Kyle Lo, Kirk Roberts, Ian Soboroff, and Lucy Lu Wang. 2021. TREC-COVID: constructing a pandemic information retrieval test collection. In ACM SIGIR Forum, Vol. 54. ACM New York, NY, USA, 1–12

    2021

  51. [59]

    Calvin Wang, Joshua Ong, Chara Wang, Hannah Ong, Rebekah Cheng, and Dennis Ong. 2024. Potential for GPT technology to optimize future clinical decision-making using retrieval-augmented generation. Annals of Biomedical Engineering 52, 5 (2024), 1115–1118

    2024

  52. [60]

    Hongru Wang, Wenyu Huang, Yang Deng, Rui Wang, Zezhong Wang, Yufei Wang, Fei Mi, Jeff Z Pan, and Kam-Fai Wong. 2024. Unims-rag: A unified multi- source retrieval-augmented generation for personalized dialogue systems. arXiv preprint arXiv:2401.13256 (2024)

    2024 arXiv

  53. [61]

    Wikipedia. 2024. Statistical Hypothesis Test . https://en.wikipedia.org/wiki/Statistical_hypothesis_test

    2024

  54. [62]

    Yihan Wu, Zhengmian Hu, Hongyang Zhang, and Heng Huang. 2023. Dipmark: A stealthy, efficient and resilient watermark for large language models. arXiv preprint arXiv:2310.07710 (2023)

    2023 arXiv

  55. [63]

    Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk. 2020. Approximate nearest neighbor nega- tive contrastive learning for dense text retrieval. arXiv preprint arXiv:2007.00808 (2020)

    2020 arXiv

  56. [64]

    YAGO. 2024. YAGO Knowledge. https://yago-knowledge.org/

    2024

  57. [65]

    Shi-Qi Yan, Jia-Chen Gu, Yun Zhu, and Zhen-Hua Ling. 2024. Corrective retrieval augmented generation. arXiv preprint arXiv:2401.15884 (2024)

    2024 arXiv

  58. [66]

    Xi Yang, Kejiang Chen, Weiming Zhang, Chang Liu, Yuang Qi, Jie Zhang, Han Fang, and Nenghai Yu. 2023. Watermarking text generated by black-box language models. arXiv preprint arXiv:2305.08883 (2023)

    2023 arXiv

  59. [67]

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William W Cohen, Ruslan Salakhutdinov, and Christopher D Manning. 2018. HotpotQA: A dataset for di- verse, explainable multi-hop question answering. arXiv preprint arXiv:1809.09600 (2018)

    2018 arXiv

  60. [68]

    Hanlin Zhang, Benjamin L Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. 2023. Watermarks in the sand: Impossibility of strong watermarking for generative models. arXiv preprint arXiv:2311.04378 (2023)

    2023 arXiv

  61. [69]

    2024.{REMARK-LLM}: A robust and efficient watermarking framework for generative large language models

    Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushan- far. 2024.{REMARK-LLM}: A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24). 1813–1830

    2024

  62. [70]

    Yue Zhang, Yafu Li, Leyang Cui, Deng Cai, Lemao Liu, Tingchen Fu, Xinting Huang, Enbo Zhao, Yu Zhang, Yulong Chen, et al . 2023. Siren’s song in the AI ocean: a survey on hallucination in large language models. arXiv preprint arXiv:2309.01219 (2023)

    2023 arXiv

  63. [71]

    Zhi-hao Zhang, Xiao-Ming Jin, Jian-Min Wang, and De-Yi Li. 2004. Watermarking relational database using image. In Proceedings of 2004 International Conference on Machine Learning and Cybernetics (IEEE Cat. No. 04EX826) , Vol. 3. IEEE, 1739– 1744

    2004

  64. [72]

    Huaqin Zhao, Zhengliang Liu, Zihao Wu, Yiwei Li, Tianze Yang, Peng Shu, Shaochen Xu, Haixing Dai, Lin Zhao, Gengchen Mai, et al. 2024. Revolutionizing finance with llms: An overview of applications and insights. arXiv preprint arXiv:2401.11641 (2024)

    2024

  65. [73]

    Pengyuan Zhou, Lin Wang, Zhi Liu, Yanbin Hao, Pan Hui, Sasu Tarkoma, and Jussi Kangasharju. 2024. A survey on generative ai and llm for video generation, understanding, and streaming. arXiv preprint arXiv:2404.16038 (2024)

    2024 arXiv

  66. [74]

    What is the relationship between 𝑒𝑖𝑤𝑚 and𝑒𝑗 𝑤𝑚?

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2024. Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large lan- guage models. arXiv preprint arXiv:2402.07867 (2024). Appendix A Datasets • TREC-COVID is a dataset based on COVID-19 literature...

    2024 arXiv

  67. [78]

    **Direct Evaluation**: - **Watermark Discriminator 1 (WD1)**: This model evaluates whether the watermark text (WT) accurately implies the relationship (R1) between (E1) and (E2)

  68. [79]

    - **Watermark Discriminator 2 (WD2)**: After the extrac- tion, this model assesses whether the relationship (R1) is still clearly and accurately implied

    **Extractor-Based Evaluation**: - **Watermark Extractor (WE)**: This model attempts to extract the relationship (R1) between (E1) and (E2) based on the restored water- mark text (WT) and additional database content (TEXT). - **Watermark Discriminator 2 (WD2)**: After the extra...

  69. [80]

    watermark_text

    Both discriminators (WD1 and WD2) confirm that the relationship (R1) is correctly encoded. 3. The generated watermark text (WT) should be approximately 30 words long. 4. Ensure that appending the watermark text (WT) to (TEXT) does not result in incoherent or unrelated sen- ten...

  70. [81]

    One sentence includes the meaning expressed in the other sentence

  71. [82]

    llm_text

    The two sentences express the same central idea but in different ways. Sentence 1: {baseline_item["llm_text"]} Sentence 2: {llm_text_item["llm_text"]} Output: ’yes’ or ’no’ only, No explanations, no extra text. C Some Examples for RAG-WM C.1 Examples of Injected Watermark We s...

  72. [2018]

    In 27th USENIX security symposium (USENIX Security 18)

    Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In 27th USENIX security symposium (USENIX Security 18) . 1615–1631

  73. [2022]

    arXiv preprint arXiv:2212.10509 (2022)

    Interleaving retrieval with chain-of-thought reasoning for knowledge- intensive multi-step questions. arXiv preprint arXiv:2212.10509 (2022)

    2022 arXiv

  74. [2023]

    arXiv preprint arXiv:2306.04634 (2023)

    On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04634 (2023)

    2023 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.