{"id":"ee06764c-6d15-491d-974e-d87482cf7e55","arxiv_id":"2502.05425","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"ITSmark embeds multi-bit copyright watermarks during LLM text generation so that authorized extractors recover the full watermark and trace tampered locations.","lead":"ITSmark is a new way to hide a custom copyright message inside text generated by large language models for intelligent transportation systems. An authorized receiver can recover the whole message and pinpoint where the text was altered, which is meant to make traffic data sharing more trustworthy.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section III.C explicitly permits p=0, so a token can embed zero watermark bits; when a high-probability token's segment exceeds half the 2^epsilon space, p=0 is forced. The paper never proves every bit is eventually embedded, so the 'entire extraction' guarantee is unsupported.","rationale":"The reader identified the p=0 progress gap as the weakest assumption, and my independent reading agrees: it is the single most load-bearing issue for the central 'entire extraction' claim. The paper's own equations allow p=0, and the design of the logit-based segment partition makes p=0 not merely a theoretical edge case but a structurally likely event whenever one token dominates the conditional distribution. The variance argument in Eq. (13), while sloppy, is actually a monotonicity statement and is not what sinks the paper; it is the missing proof that the watermark position advances. The experimental section reports 100% extraction success, but with no code or data, and the paper's parameter-independence assertion in Section IV-C is unsupported. The concern is fixable (e.g., by proving a lower bound on p, by constraining segment boundaries to avoid p=0, or by explicitly handling the stalled-position case), so the conditional verdict remains appropriate rather than a flat reject. No ad hominem is intended; the critique targets the missing guarantee in the algorithm specification.","tokens_in":27062,"tokens_out":8000,"duration_ms":81913,"concrete_test":"Re-implement the partition of Section III.B/III.C exactly as specified, using the released hyperparameters (lambda=1.0, epsilon=16, top-k=40) on the four datasets with the short watermarks from Table VI, and log p at every generated token. Then verify: (1) whether any token has p=0; (2) whether the concatenation of extracted p-bit prefixes equals the embedded watermark in every run. A cleaner isolate: construct a logit vector with one token of probability 0.6 and feed m_{1:epsilon} from the upper half of that token's segment; count the embedded bits. If p=0 occurs in either test, the entire-extraction claim as stated fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that authorized users can 'entirely extract the watermark.' This requires the embedded bit stream to advance by p>0 at enough tokens to cover the full watermark. In Section III.C the authors explicitly allow p=0: Eq. (14)-(15) define p as the common prefix of the segment endpoints and state p can be 0, in which case 'their match is an empty string' and the next read is m_{p+1:p+1+epsilon} = m_{1:epsilon}, so no progress is made. This is not a pathological corner: with the logit-proportional partition of Eq. (2), any token whose probability exceeds 1/2 (with lambda>=1) receives a segment longer than 2^{epsilon-1} bits; any interval longer than half the space must contain both bit strings beginning with 0 and with 1, so the common prefix of its endpoints is empty. At lambda=1.0, the experimental setting, such high-probability tokens are common in LLM decoding. For a watermark string lying in the upper part of that segment, p=0 is forced and the token contributes nothing. Section V's 'segment conflict' discussion only shows that the reading position does not jump backward; it does not show that the position eventually reaches the end of the watermark within a finite text. The reported 100% success rate in Table V cannot be checked because no code or data are released, and Section IV-C's assertion that extraction is 'independent of the parameters' is contradicted by the possibility of p=0 stalls. Thus the load-bearing guarantee of entire extraction rests on an unproven and plausibly false progress assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents ITSmark, a multi-bit watermarking scheme for LLM-generated text in intelligent transportation systems. Copyright information is converted to a binary string and read in ε-bit windows; each window is located in a logit-weighted partition of the 2^ε bit space and the containing segment determines the next generated token. Extraction reverses this mapping: each observed token identifies its segment, and the common prefix of that segment's endpoints is recovered as the embedded bits. Extraction is gated by cipher data and a private key, and tamper localization is performed by a token-rank heuristic. Experiments against KGW and CTWL report improved perplexity, BERTScore, and ROUGE, 100% extraction success, unforgeability, permission-failure behavior, and ablations over η, λ, and ε.","tokens_in":27424,"tokens_out":10676,"duration_ms":120674,"significance":"The application is timely for T-ITS, and the construction has attractive properties: deterministic embedding/extraction if the partition and logits are fixed, no parameters fitted to produce the headline success-rate numbers, a built-in access-control layer, and a concrete tamper-tracing mechanism. The paper also scopes out strong robustness clearly. However, the distinguishing claim of entire extraction is not established: the scheme explicitly allows zero-bit progress, and no proof or stress test shows that the read pointer eventually reaches the end of the watermark. The empirical 100% extraction rate cannot be independently checked because no code or data are released. These gaps do not disprove the idea, but they leave the main advertised guarantee unsupported.","major_comments":[{"comment":"The load-bearing progress assumption is unproved. Equations (14)–(15) explicitly allow p=0, and the text states that in this case the match is an empty string and the next read is m_{1:ε}, so the watermark pointer does not advance. The paper never proves that a finite generated text embeds all a watermark bits; the Section V discussion of segment conflict only shows that the pointer does not jump backward, not that it eventually reaches the end. Because the abstract and Section IV.C advertise entire extraction, this is a central gap. A concrete remedy would be a construction or proof that every relevant ε-bit window lies in a segment with p ≥ 1, or a bound on the number of tokens needed to embed a bits. For reference, I do not think the variance-derivative objection to Eq. (13) lands: p_i and ln P_i are similarly ordered, so the derivative is indeed non-negative.","section":"§III.C, Eq. (14)–(15)"},{"comment":"The claim that complete extraction is independent of λ, ε, and η is asserted without support and is inconsistent with the mechanism as written. The value of p is determined by segment endpoints, which depend on λ and the logit distribution; ε sets the size of the read window; and partial embedding with ratio η decides which sentences carry any bits at all. The 100.00% success rates in Table V are not accompanied by code, data, or an analysis of how often p=0 occurs, so the empirical result cannot be separated from the missing progress guarantee.","section":"§IV.C, Table V"},{"comment":"The extraction algorithm lacks a termination condition and a rule for handling the final partial window. It outputs p bits per token, but it never specifies how the extractor knows the watermark length a, when to stop reading tokens, or what to do when p exceeds the number of remaining watermark bits. Without these details, \"entire extraction\" is not a well-defined procedure, especially if p=0 stalls can occur.","section":"§III.D, Algorithm 1"},{"comment":"There is a mismatch between the full-vocabulary description and the Top-k description. Algorithm 1 and Section III.B describe dividing the bit space according to the full vocabulary V, while Section IV.F states that the candidate pool is Top-k with k=40 and that the selected token must lie in that pool. If embedding and extraction use different token sets, the inverse property fails. The paper should state exactly which token set is used at both ends and prove that every token selected during embedding is also in the extraction set.","section":"§III.B and §IV.F"}],"minor_comments":[{"comment":"The caption contains a typo: \"ESM ARK\" should be \"ITSmark.\"","section":"Table V caption"},{"comment":"The notation p(l, j, i) for segment length is easily confused with the common-prefix length p introduced later in Section III.C; consider renaming one of them.","section":"Eq. (2)"},{"comment":"The symbol \"In\" should be \"ln\", and the phrase \"this deviation is non-negative\" should be \"this derivative is non-negative.\"","section":"Eqs. (7)–(13)"},{"comment":"The labels \"The beginning and end\" are vague; annotating the segment endpoints β and β′ directly would make the figure self-contained.","section":"Fig. 3"},{"comment":"Table II's presentation of dataset statistics is hard to read; the units (average tokens per text versus total tokens) should be stated explicitly in the table.","section":"§IV.A"},{"comment":"The unforgeability discussion would be clearer if actual ROC-AUC values were reported numerically rather than only through curves, since \"smaller AUC\" is otherwise ambiguous.","section":"§IV.D"}],"recommendation":"major_revision","confidential_remarks":"The title page states that the work was accepted for publication in IEEE Transactions on Intelligent Transportation Systems with a DOI. If this manuscript is the accepted version being put on arXiv rather than a new submission, the editorial handling should take that provenance into account; the concerns in the major comments would then be relevant to a corrigendum or follow-up rather than to the acceptance decision for this version."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a real, workable-looking extension of logit-based multi-bit watermarking, and the common-prefix segment trick is the one piece I hadn't seen in CTWL or the other baselines. But the headline guarantee is not proved, and the 100% extraction numbers cannot be checked.\n\nWhat is new and good: the reversible mapping from token to segment to common prefix of segment endpoints is clever. It gives a concrete way to embed a variable number of bits per token and to advance through the watermark. The encrypted parameter handoff is a simple but sensible addition: nobody extracts without the private key and the cipher data. The quality comparison against KGW and CTWL looks reasonable, and the reported BERTScore/ROUGE improvements are plausible. The paper is honest that tamper tracing is a simple heuristic, and the experimental design is broad enough for a systems-oriented venue.\n\nThe soft spots, in order of severity. First, the load-bearing flaw: Section III.C explicitly allows p=0, meaning a token can embed zero watermark bits. The paper never proves that the watermark chunk eventually makes positive progress. This is not a corner case. With λ=1.0 and a top-k pool of 40, a high-probability token gets a long segment; any segment longer than half the 2^ε space contains both a 0-leading and a 1-leading string, so its endpoints have empty common prefix. The Section V \"segment conflict\" discussion only shows the read position does not go backward; it does not show the position reaches the end of the watermark. Since \"entire extraction\" is the central claim, this gap matters. It is fixable, but it has to be fixed.\n\nSecond, no code or data is released, so the 100% success rate in Table V is unverifiable. For a paper whose guarantee is exactly that number, this is a real problem. Third, the tamper-location heuristic in Eq. 17 is hand-set with no error analysis; the authors admit this, so I treat it as minor.\n\nOne point where I disagree with the stress-test note: the variance derivative in Eq. 13 is actually fine. The derivative is a weighted covariance between p_i and log P_i, which is non-negative. That specific criticism should not go into a review.\n\nBottom line: this paper is for researchers working on multi-bit LLM watermarking and data provenance. It is not a major scientific advance, but it is more than a rehash. The central idea may work, but the stated guarantee is not demonstrated. A serious referee should engage with it, asking for a proof of progress (or a bound on failure probability) and for code/data. My verdict: conditionally acceptable, not as written.","headline":"ITSmark is a genuinely new multi-bit watermarking construction, but its central \"entire extraction\" guarantee rests on an unproven progress assumption (p=0 stalls) and no released code; worth refereeing for the core idea, not for the claims as stated.","tokens_in":27962,"tokens_out":3400,"would_cite":false,"duration_ms":39723,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ITSmark hides and fully recovers multi-bit watermarks in AI-generated traffic text, and only key-holders can extract them.","keywords":["multi-bit watermarking","large language models","intelligent transportation systems","copyright protection","tamper localization","permission verification","text watermarking","extraction accuracy"],"falsifier":"Generate a large batch of watermarked texts with ITSmark on contexts where the model is highly confident (low-entropy next-token distributions) and compare the extracted watermark bit-by-bit with the embedded message; if any text shows an embedding step where the segment endpoints share no common prefix, the complete-extraction claim fails for that text.","tokens_in":26814,"feed_emoji":"🛡️","tokens_out":5160,"duration_ms":45552,"temperature":0.7,"pith_summary":"This paper proposes ITSmark, a watermarking scheme that hides a custom multi-bit message, such as copyright information or a timestamp, inside text generated by a large language model, with the goal of protecting intelligent transportation data. The work tries to establish three capabilities that prior text watermarks lack: complete extraction of the embedded message, permission-gated extraction so that only authorized verifiers can recover it, and localization of tampered positions without access to the original document. If the scheme works as claimed, ITS departments and data-sharing platforms could verify the origin and integrity of AI-generated traffic reports and identify exactly which tokens were altered or forged. The authors report that ITSmark beats existing zero-bit and multi-bit baselines in data quality, extraction accuracy, and resistance to automatic detection, and that extraction succeeds completely in their experiments.","feed_headline":"ITSmark hides and fully recovers multi-bit watermarks in AI text","feed_subtitle":"Only verifiers with the right cipher and private key can extract; tampered tokens are traced by rank.","key_machinery":"The load-bearing object is the multi-bit space B, the set of all binary strings of length ε, divided into consecutive bit segments S. Each candidate token is assigned the segment whose length is proportional to its logit raised to a weight λ, and the token whose segment contains the current watermark chunk is chosen as the next token; at extraction, the same logits and the chosen token locate the segment, and the longest common prefix of the segment's lower and upper endpoints gives the embedded bits. This segment-prefix mechanism is what converts the one-to-many mapping from token back to watermark into a one-to-one reversible mapping, and it is what permits both complete extraction and tamper localization by rank.","core_discovery":"The central claim is that a multi-bit watermark can be embedded reversibly by making the next token's choice depend on the watermark: the copyright string is converted to bits, read a few bits at a time, and each chunk is located inside the space of all binary strings of that length, which is partitioned into contiguous segments weighted by the model's logits. The token whose segment contains the current chunk is generated, so the produced text literally contains the message. Because extraction replays the same logits and segment partition, the token reveals its segment, and the common prefix of that segment's endpoints recovers exactly the bits that were embedded at that step; the authors argue this inverse mapping makes embedding and extraction independent of the hyperparameters and gives complete extraction accuracy on the TV, BDD, AlpacaFarm, and FinQA datasets with LLaMA2-7B and ChatGLM3-6B. Encryption of the prompt and parameters into cipher data, plus a private key requirement, makes extraction fail for unauthorized users, and tokens whose likelihood rank falls outside the trusted top-k range are flagged as tampered.","pith_inferences":["The paper leaves open whether the logit-based partition guarantees that every watermark chunk shares at least one leading bit with its assigned segment; if p=0 occurs for a required chunk, the chunk would be skipped and the advertised complete-extraction guarantee would fail, so a direct audit of p=0 frequency on low-entropy contexts would settle the matter.","The unforgeability result is measured as indistinguishability from unwatermarked text by a RoBERTa classifier, not as resistance to an adversary who knows the scheme; a stronger test would be adaptive forgery attempts with known parameters.","The tamper-tracing rule is a simple hand-set ranking heuristic; it could be turned into a calibrated probabilistic model by fitting the distribution of token ranks under substitution and rewrite attacks.","The same reversible multi-bit space idea transfers beyond ITS to any domain with LLM-generated text, such as legal or medical reporting, wherever provenance and edit localization matter."],"forward_implications":["If the segment-prefix mechanism is correct, any LLM can carry ITSmark without retraining: the scheme needs only the base model's logits at generation and extraction time.","Authorized recipients can authenticate the origin of a traffic report and recover the full copyright string without needing the original unwatermarked text.","A failed full extraction after successful permission verification signals tampering, and the rank-based rule localizes the edited tokens within seconds.","Users can tune embedding load: smaller embedding ratios and larger λ preserve text quality, while smaller λ and larger ε increase payload, so the scheme adapts to short versus long copyright messages.","Because extraction failure is all-or-nothing without the key, ITSmark also acts as an access control layer on top of integrity checking."],"supporting_citations":[{"why":"Supplies the green-red list logit-modification baseline KGW-1/KGW-2 that ITSmark must beat in quality and unforgeability.","marker":"[21]"},{"why":"Supplies the multi-bit baseline CTWL-5/CTWL-10 whose extraction is not fully inverse, the key comparison for the complete-extraction claim.","marker":"[34]"},{"why":"Frames the zero-bit versus multi-bit taxonomy and the unforgeability concern that motivates private detection.","marker":"[24]"},{"why":"Provides the robust multi-bit watermarking reference via error correction codes that ITSmark contrasts with its fragile integrity-focused design.","marker":"[33]"},{"why":"Supplies LLaMA2-7B, one of the two base models on which ITSmark is evaluated.","marker":"[54]"},{"why":"Supplies ChatGLM3-6B, the second base model used in the evaluation.","marker":"[55]"},{"why":"Provides RoBERTa, the classifier used for unforgeability testing and for word-level substitution attacks in tamper tracing.","marker":"[71]"},{"why":"Supplies the TV and BDD traffic datasets used to evaluate ITSmark's data quality and extraction performance.","marker":"[65]"}],"fun_headline_variants":["ITSmark embeds multi-bit watermarks in AI text for full recovery","AI text watermarking: reversible multi-bit embedding with encrypted extraction","ITSmark: reversible multi-bit watermarking for AI text","Watermarking AI text: embed multi-bit, extract with private key","ITSmark: AI text watermarking that is fully recoverable and tamper-aware"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme assumes that at every step of generation, the next piece of the watermark can be matched to the beginning of at least one allowed token's range, so no watermark bit ever has to be skipped.","fun_headline_variants_meta":{"raw":{"variants":["ITSmark embeds multi-bit watermarks in AI text for full recovery","AI text watermarking: reversible multi-bit embedding with encrypted extraction","ITSmark: reversible multi-bit watermarking for AI text","Watermarking AI text: embed multi-bit, extract with private key","ITSmark: AI text watermarking that is fully recoverable and tamper-aware"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001122,"raw_usage":{"total_tokens":4703,"prompt_tokens":1012,"completion_tokens":3691,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":628,"completion_tokens_details":{"reasoning_tokens":3598}},"tokens_in":628,"tokens_out":3691,"duration_ms":24451,"temperature":1.0,"reasoning_tokens":3598,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T19:23:05.242695+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate a large batch of watermarked texts with ITSmark on contexts where the model is highly confident (low-entropy next-token distributions) and compare the extracted watermark bit-by-bit with the embedded message; if any text shows an embedding step where the segment endpoints share no common prefix, the complete-extraction claim fails for that text.","supporting_citations":[{"cited_title":"A Watermark for Large Language Mod- els,","cited_arxiv_id":null,"evidence_quote":"Supplies the green-red list logit-modification baseline KGW-1/KGW-2 that ITSmark must beat in quality and unforgeability."},{"cited_title":"Towards Codable Watermarking for Injecting Multi-bits Information to LLMs,","cited_arxiv_id":null,"evidence_quote":"Supplies the multi-bit baseline CTWL-5/CTWL-10 whose extraction is not fully inverse, the key comparison for the complete-extraction claim."},{"cited_title":"A Survey of Text Watermarking in the Era of Large Language Models,","cited_arxiv_id":null,"evidence_quote":"Frames the zero-bit versus multi-bit taxonomy and the unforgeability concern that motivates private detection."},{"cited_title":"A Study of Situational Reasoning for Traffic Understanding,","cited_arxiv_id":null,"evidence_quote":"Supplies the TV and BDD traffic datasets used to evaluate ITSmark's data quality and extraction performance."}],"review_version":1}