2026 Theses Doctoral

Cryptographic Watermarks for AI-Generated Content

Christ, Miranda

Watermarks enable the identification of AI-generated content by embedding invisible markers that can be algorithmically detected. In addition to being reliably detectable, watermarks should preserve the quality of the underlying generative model. These two properties, detectability and quality, seem to be at odds: the more one preserves the content, the less freedom one has in embedding these markers.

In this thesis, we use cryptography to overcome this barrier: we construct watermarks that strongly preserve quality and are detectable even after adversarial modification. Our first contribution is formalizing a strong yet achievable definition of quality: the watermarked model should be computationally indistinguishable from the original model. We then show that these robust and quality-preserving watermarks are equivalent to a new cryptographic primitive called a pseudorandom error-correcting code.

A pseudorandom code is a keyed error-correcting code for which any polynomial number of codewords are pseudorandom. We construct the first pseudorandom codes from standard cryptographic assumptions. We then show how to boost their robustness, allowing them to withstand even errors chosen by adversaries with access to encoding and decoding oracles. Applying these pseudorandom codes, we obtain language model watermarks that remain detectable under a constant fraction of substitutions, even if an attacker can query both the watermarked model and the detection oracle.

Beyonod their use in watermarking, pseudorandom codes are interesting theoretical objects in their own right. In the final chapter of this thesis, we survey the literature surrounding pseudorandom codes and develop a taxonomy of definitions, constructions, and techniques. We conclude by identifying open questions for future work.