Protecting Creative Writing Copyright against AI Imitation via Implicit Watermarking

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Next we'll be talking about the paper "Protecting Creative Writing Copyright against AI Imitation via Implicit Watermarking".

Jane: The paper was written by Ziwei Zhang, Juan Wen, Wanli Peng, Zhengxian Wu, Yinghan Zhou et al. from China Agricultural University.

Tom: Stay tuned as we take you through the paper and discuss its implications.

Title: Tom: Welcome back to the channel, everyone. I'm Tom, and I've got Jane here with me, and we are looking at a paper that just landed on arXiv called "Protecting Creative Writing Copyright against AI Imitation via Implicit Watermarking." Jane, I have to say, the title alone got me excited, because we've talked a lot about AI stealing images, but creative writing has been this huge blind spot.

Jane: Absolutely, Tom. And I love that the title says "implicit watermarking," because that's the clever part. Normally, when we think of a watermark, we think of something you can see, like a logo stamped on a photo. But you can't stamp a watermark onto a story without ruining the story itself. So this paper is asking, how do you protect the *essence* of someone's writing without changing a single word?

Tom: Right, and that's the core problem. The authors are from China Agricultural University, which is interesting, and they're tackling the fact that anyone can feed a few chapters of a novel into an LLM and say, "write more in this style." The model picks up the voice, the rhythm, the word choices, and suddenly you've got a machine producing something that feels like Stephen King, but it's not his work.

Jane: And the paper makes a really important distinction. This isn't about figuring out who wrote a text after the fact. That's authorship attribution, which is a whole different field. This is about proactively creating a signature for a protected work, so that later, if you see a suspicious AI-generated text, you can verify whether it inherited that creative essence. It's like leaving a fingerprint on an idea, not on a sentence.

Tom: Exactly. And the way they do it is by breaking down "creative essence" into five concrete pieces. Vocabulary and word choice, syntax and grammar, rhetorical devices, tone and sentiment, and rhythm and flow. I love that they didn't just say "style" and leave it vague. They actually decomposed it into things you can measure.

Jane: That decomposition is what makes the whole thing work, Tom. Because once you have those five elements, you can ask a large language model to extract them from a piece of writing, and that becomes a condensed signature. It's like taking a whole symphony and writing down just the melody line. You lose the orchestration, but you keep what makes it recognizable.

Tom: And that's the hook for me. This could change how we think about copyright in the age of generative AI. It's not about blocking the models from reading the text. It's about giving authors a way to prove that a machine copied their *voice*, even if it didn't copy their sentences. Jane, I think we need to get into how they actually build this watermark, because the methodology is wild.

Jane: We absolutely do, because the next segment is all about the summary of the paper and the actual framework they built. Stick around, because this is where it gets technical, but I promise we'll keep it grounded.

Summary: Tom: So we're back, and we're still on "Protecting Creative Writing Copyright against AI Imitation via Implicit Watermarking." Jane, we teased the five elements, but the real meat is in the framework they call WIND, which stands for Watermarking via Implicit and Non-disruptive Disentanglement.

Jane: And that name is actually perfect, Tom. "Non-disruptive" means they don't touch the original text at all. This is what's called a zero-watermarking framework. You don't inject anything into the story. Instead, you extract a signature *from* the story and store it separately. That's a huge deal because any modification to creative writing can destroy the fragile qualities that make it good.

Tom: Right, and the way they extract that signature is the clever part. They use an LLM, like GPT-three point five or Grok, to read a piece of protected writing and produce what they call a "condensed-list." That list captures those five elements we mentioned. But here's the twist, Jane. They don't just feed the text to the LLM and hope for the best. They have this thing called an "instance delimitation mechanism."

Jane: Which is a mouthful, but the idea is simple. Before they ask the LLM to analyze a text, they first figure out which other texts are most similar to it. They use a sentence encoder to find the nearest neighbor for each sample. If the nearest neighbor is also from the protected style, they pair them up and give the LLM both texts. That gives the LLM a reference point, so it knows what to focus on.

Tom: And that matters because LLMs are sensitive to prompts. If you just say "analyze this style," you might get generic answers. But if you say "here are two texts that share a style, tell me what they have in common," the model does a much better job of isolating the creative essence from the random content. The paper actually shows that removing this delimitation step drops the F1 score by about nine points.

Jane: Nine points is significant. And once they have those condensed-lists, they map them into a watermark space. They use a learnable matrix to turn each list into a binary string, a sequence of ones and zeros. Texts that imitate the protected style get pushed toward a fixed "anchor" string, and unrelated texts get pushed toward the opposite string. That way, verification is just a matter of checking the Hamming distance.

Tom: And the results are impressive. On their main experiments, they're hitting over ninety-eight percent F1 scores, with false positive rates down around one percent. That means when they say a text is imitating the protected style, they're almost always right. And they compared against fine-tuned classifiers like BERT and RoBERTa, and WIND just blows them out of the water, especially when you only have ten or twenty examples to work with.

Jane: That few-shot capability is what makes this practical, Tom. You don't need a massive corpus of an author's work to protect them. Ten samples is enough. And that's the summary of the paper in a nutshell. But what I really want to dig into next is how they prove this thing is robust. Because anyone can build a detector that works in a lab. The question is, does it survive an attacker trying to break it?

Tom: And that's exactly the next segment, Jane. We're going to talk about the robustness studies and the attacks they threw at this system. Stay with us.

Improvements: Tom: Welcome back. We're still on "Protecting Creative Writing Copyright against AI Imitation via Implicit Watermarking," and Jane, we just said the word "robustness." So let's talk about what happens when an attacker tries to mess with the watermark.

Jane: Right, and this is where the paper gets really fun, Tom. They tested WIND against a bunch of common text attacks. Things like swapping letter cases, introducing misspellings, inserting random numbers, adding extra paragraph breaks, and even having another LLM rewrite the text entirely. The idea is that an attacker might try to disguise an imitation by making small edits that don't change the creative essence but might confuse a detector.

Tom: And the results are honestly surprising. Even under those attacks, the F1 scores stay above ninety-five percent. The rewrite attack is the toughest one, which makes sense, because rewriting changes the surface text a lot. But even then, they're at ninety-five point four eight percent F1, which is still really strong. The watermark is tied to the creative essence, not the exact wording, so superficial changes don't break it.

Jane: And that's the key improvement this paper suggests over existing methods. The old watermarking techniques, like KGW or SynthID, work by modifying the token generation process of an LLM. That means they can only protect text that the LLM itself generates with that watermark. But WIND doesn't care about the generating model at all. It works on any text, from any model, because it's extracting the style, not checking for an injected signal.

Tom: That's a massive difference. And they also did an ablation study, which is where you remove one piece of the system to see how much it matters. They found that removing the watermark loss, the thing that pushes imitations toward the anchor, drops the F1 score to seventy-three percent. That's a huge drop. And removing the instance delimitation, which we talked about earlier, drops it to about eighty-nine percent.

Jane: So every piece matters, but the watermark loss is the backbone. And they also tested different combinations of the five creative elements. Using all five is always better than using a subset. For example, on the Shakespeare dataset, using just syntax and tone gets you ninety-four point two seven percent F1, but adding vocabulary and word choice pushes it to ninety-seven point two one percent. Each element adds a little more coverage.

Tom: And they even tested cross-model generalization. They trained on texts generated by GPT-three point five and tested on texts generated by Grok, and vice versa. The performance stays high, around ninety-six to ninety-seven percent F1. That's important because in the real world, you don't know which LLM an attacker is going to use. WIND doesn't lock onto a specific model's quirks. It locks onto the creative style.

Jane: And that's the improvement that matters most, Tom. This isn't just a lab experiment. It's a system that could actually be deployed to protect authors right now. But before we wrap up, I want to hear what you think the bigger picture is. Where does this leave us in the fight between creators and generative AI?

Tom: That's the perfect question for our final segment, Jane. We're going to step back and talk about what this means for the world, and then we'll say goodbye to this paper. Don't go anywhere.

Conclusion: Tom: So we're at the end of our time with "Protecting Creative Writing Copyright against AI Imitation via Implicit Watermarking," and Jane, I want to zoom out. What does this paper actually change?

Jane: It changes the conversation, Tom. For a long time, copyright protection for text felt impossible because you can't stop a model from reading a book. But this paper shows that you don't have to stop the reading. You just have to make the copying verifiable. If an author registers their work with WIND, they get a watermark anchor. Later, if they suspect an AI-generated text is imitating them, they can test it against that anchor and get a clear yes or no.

Tom: And that's a legal tool as much as a technical one. Courts are already dealing with cases like The New York Times suing OpenAI. Having a verifiable, quantitative measure of style imitation could be the evidence that makes or breaks those cases. It moves the argument from "this feels like my writing" to "here is a ninety-eight percent match against my registered creative signature."

Jane: Exactly. And the fact that it works with just ten samples is huge. You don't need to have written a hundred novels to get protection. A short story collection, a blog, even a few essays could be enough. That democratizes the protection, which is important because it's not just famous authors who get imitated. Small creators, journalists, poets, they all have voices worth protecting.

Tom: And I love that the paper is honest about its limitations. They say the main weakness is the disentanglement performance. If a style is too close to another style, or if the creative essence is too subtle, the watermark might not separate them cleanly. But that's a direction for future work, not a reason to dismiss the approach.

Jane: Right, and future work could also expand the five elements. They mention integrating style-specific elements to broaden the expressive scope. Maybe for poetry you need different features than for technical writing. The framework is flexible enough to adapt.

Tom: So as we say goodbye to this paper, I think the takeaway is that creative writing now has a seat at the table. Images have had watermarks for years. Text was the wild west. WIND brings law and order to that frontier, without ever touching a single word of the author's work.

Jane: And that's the beautiful part, Tom. The author's text stays pristine. The watermark lives in a separate space, waiting to be called upon when needed. It's protection without interference. And with that, we're going to wrap up our discussion of "Protecting Creative Writing Copyright against AI Imitation via Implicit Watermarking." Thanks for listening, everyone.

Tom: Next up, we've got a paper on multimodal reasoning that we're excited to dig into. But for now, this is Tom and Jane, signing off. Keep reading, keep writing, and keep your voices your own.