{"id":"65510143-7af4-4cca-a1cf-6f3317f83aa4","arxiv_id":"2506.13494","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":7,"one_line_summary":"Watermarks such as trigger words, rare tokens, and grammatical style changes can often be detected in downstream models trained on LLM-generated data, but effectiveness and false positives vary sharply.","lead":"This paper hides watermarks inside text datasets generated by large language models, so that a model owner can later check whether someone trained a new model on that data. The authors test two settings: classification datasets and generated-answer datasets, with mixed results on detection and data quality.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central detection claim depends on the adversary not cleaning the generated dataset, a step Section 9 concedes nullifies backdoor-based watermarks; the abstract presents this as unconditional high effectiveness.","rationale":"The reader identified the adversary's willingness to filter the generated dataset as the weakest assumption, and I agree. This is the single most load-bearing concern because it directly invalidates the detection claim: if the adversary can cheaply remove watermarked samples before training, the downstream model never acquires the watermark, so every reported WSR becomes irrelevant to the adversarial setting the paper claims to address. The paper itself acknowledges this in Section 9, which makes it an internally admitted limitation rather than an external critique. Other concerns, such as utility degradation in the steganographic method (Table 4: MAUVE 0.407 vs. baseline 0.776) and the weak watermark failing on DialogSum, are real but secondary; they affect practicality, whereas the filtering issue determines whether the watermark survives at all. The proposed test is concrete and would settle the matter by measuring WSR after a minimal, automated cleaning step. Since the reader already rendered a CONDITIONAL verdict and this concern reinforces the need to narrow the claims and disclose the threat-model dependence, no change to the verdict is needed.","tokens_in":25460,"tokens_out":6324,"duration_ms":65965,"concrete_test":"Regenerate or obtain the watermarked AG News dataset used for the traditional watermark (Llama upstream, BERT downstream), then apply an automated filter that removes every training sample containing the trigger token, retrain the BERT classifier on the filtered dataset, and measure WSR on the same trigger-embedded test set. If WSR drops to the no-watermark baseline (near 0), the persistence claim fails under the paper's own threat model. Repeat for the robust watermark by removing all samples containing the token 'ikun', and for the stylistic watermark by filtering out samples with poetic formatting (e.g., three-line structure).","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that watermarks persist in downstream models and enable detection of unauthorized dataset use. For that claim to hold, the watermark must survive the adversary's training pipeline. But the adversary is exactly the party who receives the generated dataset, and nothing in the threat model prevents them from inspecting it before training. Section 9 explicitly concedes: 'if adversaries were to implement systematic dataset filtering protocols, particularly backdoor-based watermarking methodologies could be readily detected and subsequently nullified.' This is not a peripheral caveat; it targets the main detection mechanisms. The traditional trigger watermark is a visible token in the generated text, the robust watermark uses a conspicuous token such as 'ikun' (Section 6.2.2), and the stylistic watermark uses an easily identifiable poetic form. An automated filter that removes samples containing the trigger or the rare token, or that flags poetic formatting, would leave the downstream model with no watermark to learn. All the reported WSR values (Figures 1, Tables 2-5) are measured on models trained on unfiltered watermarked data, so they measure persistence only under a cooperative adversary. The paper's defense that manual filtering is labor-intensive does not apply to the robust watermark, where a single rare token can be removed by frequency-based or string-matching filters. Because the abstract and conclusion claim 'high effectiveness' and 'diverse datasets... without compromising utility' without stating this condition, the central claim is stronger than the evidence supports.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes watermarking methods for LLM-generated datasets so that an LLM owner can detect unauthorized downstream use. It distinguishes input-level tasks (classification, where a trigger or stylistic watermark is embedded in generated training text) and output-level tasks (generation, where weak, robust, or steganographic watermarks are embedded in generated answers). The evaluation covers two upstream LLMs, several downstream classifiers and generative models, and four datasets, reporting WSR, CTS, Z-Score, MAUVE, and PPL, plus robustness to fine-tuning, pruning, and quantization. The abstract and conclusion claim high watermark effectiveness and no significant utility degradation.","tokens_in":25683,"tokens_out":3639,"duration_ms":37399,"significance":"If the central claims held, the paper would be a useful step toward practical LLM-output provenance: it is one of few works that studies watermark persistence through downstream fine-tuning rather than only in directly sampled text. The experimental breadth is a strength, as is the inclusion of multiple attack vectors (fine-tuning, pruning, quantization). However, several load-bearing claims are contradicted by the paper's own numbers and by its admitted limitations, so the significance as stated is not yet established.","major_comments":[{"comment":"The threat model assumes the adversary receives the generated dataset and the defender does not intervene in downstream training. Section 9 concedes that if adversaries implement systematic dataset filtering, backdoor-based watermarks 'could be readily detected and subsequently nullified.' This concession directly undercuts the central detection claim for the traditional trigger (Section 3.1), the stylistic poetry trigger (Section 3.2), and especially the robust watermark, which uses a single conspicuous token such as 'ikun' (Section 6.2.2). All reported WSR values in Tables 2-5 and Figures 1-3 are measured on models trained on unfiltered watermarked data, so they demonstrate persistence only against an adversary who does not inspect or clean the data. The paper needs either new experiments under data-cleaning adversaries or a substantially narrowed claim that does not present unconditional high effectiveness.","section":"Section 9 (Limitations) and Section 2.1 (Threat Model)"},{"comment":"The section's own conclusion states: 'despite the robust watermark performance is better, we argue that this method is not an effective watermark approach due to its potential to compromise utility and its susceptibility to detection.' This directly contradicts the abstract's blanket statement that 'our results indicate the high effectiveness of our watermark approach' and the conclusion's claim that the methods demonstrate 'efficacy.' The manuscript must reconcile this internal contradiction; at minimum the abstract and conclusion should identify the robust watermark as a negative or limited result.","section":"Section 6.2.2 (Robust Watermark, Takeaways)"},{"comment":"For DialogSum, the weak watermark fails: the highest WSR across all twelve configurations is 0.100, and most Z-Scores are below the threshold of 4, including negative values such as -0.289 and -0.542. The text acknowledges that 'the average Z-Score and WSR of all models is notably low,' yet the abstract and conclusion claim high effectiveness without qualification. This is a load-bearing discrepancy between the reported evidence and the central claim, and it needs either a correction of the claim or an explanation of why DialogSum is outside the method's intended scope.","section":"Table 2 and Section 6.2.1 (Weak Watermark on DialogSum)"},{"comment":"The abstract claims 'no significant utility degradation,' but the paper's own tables show large drops. In Table 4 (present continuous), ⟨Llama, Qwen, DialogSum⟩ has MAUVE 0.407 versus the real-data baseline 0.717 in Table 1, a 0.31 drop. In Table 3 (robust), ⟨Llama, T5, AG News⟩ has MAUVE 0.395 versus the baseline 0.778, about half the baseline value. Stating that these are 'within an acceptable range' or that there is 'no significant degradation' is not supported by the reported numbers; a statistical comparison or a revised utility claim is needed.","section":"Table 4, Table 3, and Section 6.2.2/6.2.3 (Utility)"},{"comment":"For AG News, the weak-watermark training set is constructed by retaining only generated samples with a Z-Score of at least 20.000, with an average generation time of five minutes per data point. This is a self-selection step that filters the generated data to the most strongly watermarked samples, which inflates downstream watermark persistence and is not an adversarial setting. The paper should disclose the fraction of generated samples discarded, the total generation cost, and, ideally, repeat the experiment without this filtering to show the method works under the stated threat model.","section":"Section 6.2.1 and Algorithm 2 (Training-Set Selection)"},{"comment":"The conclusion states that 'contemporary watermark removal techniques exhibit limited effectiveness when applied to our proposed method,' but the fine-tuning experiments show the opposite for most methods. For the weak watermark, WSR drops to 0.000 in all configurations after fine-tuning (Table 6); for the robust watermark, WSR drops to 0.000 in all configurations (Table 7). Even the steganographic methods degrade substantially, with some WSR values falling to 0.080 (Table 8, ⟨Qwen, DialogSum⟩). The conclusion needs to be rewritten to reflect that fine-tuning is an effective removal attack for the proposed watermarks.","section":"Section 7.1 and Tables 6-9 (Fine-Tuning Removal)"}],"minor_comments":[{"comment":"There are multiple typos and inconsistent names: 'Origianl' appears in figure legends, 'Iuput-level' appears in Section 5.3, and the upstream model is called 'Ministral' in some places and 'Mistral' in others (e.g., Section 6.1). These should be fixed.","section":"Throughout"},{"comment":"The Z-Score formula is typeset ambiguously: the denominator appears as 'p γ(1−γ)T' rather than the expected square root of γ(1−γ)T. Please correct the typography to match Kirchenbauer et al.","section":"Equation (1)"},{"comment":"The loop condition 'while z < threshold' with no maximum number of iterations could loop indefinitely if the threshold is never reached; a generation cap or failure condition should be specified.","section":"Algorithm 2"},{"comment":"The text refers to the French token 'Personne2' with a capital P, while the token being replaced is described as 'personne2'; this is inconsistent and should be aligned.","section":"Section 5.2 (DialogSum)"},{"comment":"Hyperparameters for fine-tuning (learning rate, number of epochs, batch size, optimizer) are not reported, which limits reproducibility; please add a hyperparameter table or refer to a configuration file.","section":"Section 5.3 (Experimental Settings)"}],"recommendation":"major_revision","confidential_remarks":"The paper has a solid experimental core but the framing overstates the results. The most serious issue is that the threat model does not consider an adversary who cleans the generated data, and Section 9 explicitly concedes that such cleaning nullifies the backdoor-style watermarks; this should be addressed head-on rather than in a limitation paragraph. The internal admission that the robust watermark is not effective, combined with the weak watermark's failure on DialogSum, means the abstract and conclusion currently misrepresent the findings. I do not see this as a rejection: the steganographic methods show high WSR and the input-level methods show high WSR under the cooperative-adversary setting, so a revised manuscript with accurate claims and additional cleaning experiments could be a valuable contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the dataset-to-downstream-watermark setting is worth knowing about, but the headline claims are stronger than the experiments. The paper asks a real new question — can a watermark injected at generation time survive into a model fine-tuned on that data? — and it runs an admirably broad evaluation across two input-level and three output-level methods, multiple upstream/downstream models, and three attack pipelines. That breadth is the main asset.\n\nThe solid pieces: the input-level trigger and style watermarks do persist in downstream classifiers, with WSR >0.9 under their threat model, and the utility numbers there look okay. The steganographic (present-continuous/passive) watermark also appears to transfer to generation models with near-1.0 WSR, and the appendix honestly shows that fine-tuning removes most watermarks. Section 6.2.2 even admits the robust watermark (the \"ikun\" token) is conspicuous and not an effective watermark — good to see that admission.\n\nThe soft spots are load-bearing. First, the threat model: the adversary can inspect the generated dataset before training. Section 9 concedes that systematic filtering would detect and nullify backdoor-based watermarks. That covers exactly the advertised mechanisms: the trigger is a token in the text, the robust watermark is a rare token, and the stylistic watermark is a poetic form. All WSR numbers are measured on unfiltered data, so they characterize a cooperative adversary, not the unauthorized user the defender fears. Second, the weak watermark fails outright on DialogSum (WSR near 0), and the paper acknowledges it needs long outputs. Third, the abstract's \"no significant utility degradation\" is contradicted by Table 4: MAUVE drops from 0.717 to 0.407 for ⟨Llama, Qwen, DialogSum⟩ with the present-continuous watermark. Fourth, the steganographic detection uses GPT-4 with no false-positive calibration; baselines show ~15% natural occurrence of passive voice, so a 1.0 WSR is not statistically characterized. Fifth, Algorithm 1 does not explain how the trigger in the system prompt ends up in the generated training text — presumably the prompt instructs it, but that should be explicit.\n\nNone of this kills the work. The setting is novel, the eval is broad, and the limitations are partially acknowledged. But the abstract and conclusion overstate. A revision that conditions all claims on the adversary, adds false-positive rates, discloses the Z-score training filter, and ships code would turn a conditional into a solid contribution. I'd send it to review — the setting deserves referee time — but I'd expect major revision.","headline":"New setting, broad eval, but the central claims only hold if the adversary never cleans the generated data — a condition the paper concedes.","tokens_in":26291,"tokens_out":4216,"would_cite":false,"duration_ms":40416,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Watermarks injected into LLM-generated datasets can persist in downstream models, letting the original LLM owner detect unauthorized training use.","keywords":["LLM watermarking","dataset provenance","downstream fine-tuning","backdoor trigger","green-red list","steganographic text watermark","copyright protection","text classification"],"falsifier":"Take a watermarked generated dataset, run a cheap normalization pass that drops sentences containing the trigger word or style, removes the fixed rare tokens such as 'ikun' or 'personne2', and paraphrases or back-translates the rest; then fine-tune the downstream model and measure watermark success rate on marked test inputs. If WSR falls to the unwatermarked baseline while accuracy stays roughly constant, then the watermarks are not robust to ordinary data cleaning.","tokens_in":25204,"feed_emoji":"💧","tokens_out":6848,"duration_ms":68566,"temperature":0.7,"pith_summary":"Large language models are increasingly used to generate training data for other models, and this paper asks whether the original LLM owner can prove that a downstream model was trained on data their model produced. The authors' claim is that watermarks can be injected into the generated dataset at generation time, and that those watermarks survive the downstream training process well enough to be detected later, across both classification and text-generation tasks. They design five methods: two input-level triggers (a hidden backdoor word or phrase, and a poetic style) and three output-level markers (green-list token bias, fixed rare tokens, and grammatical constructions such as present continuous tense or passive voice). In experiments, input-level watermark success rates exceed 0.900, output-level syntactic markers reach 1.000, and downstream model accuracy and text quality stay close to baselines. The paper's claim is conditional: it holds when the adversary does not systematically clean or filter the generated data before training.","feed_headline":"Watermarks in AI-generated data can survive into trained models","feed_subtitle":"Hidden triggers, rare tokens, and tense rules can expose whether an AI-generated dataset was used to train another model.","key_machinery":"The load-bearing mechanism is prompt-and-decoding control at generation time: the upstream LLM's system prompt is rewritten, adding a trigger, a style instruction, a green-list bias, or a grammar rule, so that every dataset sample carries a hidden marker. Detection then consists of querying the downstream model with marked inputs for classification, or checking its outputs for the expected tokens or grammatical constructions for generation. The weak watermark is scored with a green-red list Z-score, the standard statistic comparing observed green tokens to the random expectation; the robust watermark replaces probabilistic scoring with a simple fixed-token presence test; and the steganographic watermark is verified by a separate LLM judging tense or voice. The same generation-time control is what makes the scheme work without the defender seeing the adversary's dataset or training process.","core_discovery":"The central discovery is that a defender who controls only the system prompt and decoding of an LLM can imprint a detectable pattern into every generated sample, and a model fine-tuned on that data will learn the pattern as a generalizable feature. For classification datasets, a trigger word or a poetic rewrite is appended to the prompt for one target class, so the fine-tuned classifier maps inputs carrying that trigger or style to the target class, and ownership can be verified without access to the training set. For generation datasets, the paper shows three mechanisms: a green-red list that biases token sampling (weak watermark), a fixed rare token injected into all outputs (robust watermark), and a global tense or voice transformation imposed on every answer (steganographic watermark). The measured persistence is high, with input-level watermark success rates exceeding 0.900 and grammatical markers reaching 1.000, while clean accuracy and MAUVE/PPL scores indicate that utility degradation is small. The paper also finds that a hostile fine-tuning run on clean data can erase most of these signals, and it argues that such a run is too costly for an adversary whose whole motivation is cheap data.","pith_inferences":["These markers are distributional features, not cryptographic proofs: any cleanup that normalizes style, removes rare tokens, or paraphrases syntax should dissolve them, and the paper's own limitation section concedes that systematic filtering can nullify backdoor-based watermarks.","Because grammatical markers survive downstream training so well, a natural but untested next step is to attack them with paraphrase or back-translation, which the paper does not run.","A defender could combine token and grammar markers in one dataset, raising the cost of cleaning, but this combination is not tested here.","The poetry trigger inherits the weakness that the downstream model must spontaneously learn the style, so a data-poor adversary might accept a slightly lower watermark success rate to keep text natural, as the Mistral and AG News case shows."],"forward_implications":["A defender can check a suspect model by feeding it trigger-laden or style-transformed inputs and looking for the target-class response, with no need for the original training set.","For generation models, provenance can be probed by prompting for outputs and testing whether fixed tokens or tense and voice rules appear reliably.","The weak watermark is length-dependent: it only works when generated outputs are long enough, so short summaries or answers will not carry a detectable signal.","Fine-tuning on clean real data removes most watermark signals, especially the weak and robust methods, so the scheme's practical value depends on the adversary's dataset being uncurated.","Quantization and pruning weaken detection far less than fine-tuning, so compression is not an effective removal strategy under the tested conditions."],"supporting_citations":[{"why":"Supplies the green-red list token sampling and Z-score detection that the weak output-level watermark is built on.","marker":"[16]"},{"why":"Supplies the reliability analysis and the Z-score threshold used to judge whether a weak watermark is present.","marker":"[17]"},{"why":"Supplies the style-as-trigger idea that the stylistic input-level watermark adapts to a no-intervention setting.","marker":"[37]"},{"why":"Supplies the backdoor-trigger mechanism for model watermarking that the traditional input-level watermark extends.","marker":"[4]"},{"why":"Supplies semantic-preserving backdoor trigger injection for NLP, forming the basis of the trigger-based input watermark.","marker":"[6]"},{"why":"Supplies the input-level versus output-level task taxonomy that organizes the two watermark categories.","marker":"[28]"}],"fun_headline_variants":["Watermark triggers live on in models trained on AI data","AI data watermarks persist into downstream models","Over 90% success: watermarks survive fine-tuning","Tracking LLM data through trigger words and style shifts","Hidden markers in AI datasets resist fine-tuning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole detection story depends on the adversary training on the watermarked data as generated, without systematically filtering, cleaning, or rewriting it, and the paper explicitly concedes that such filtering can detect and nullify backdoor-based watermarks.","fun_headline_variants_meta":{"raw":{"variants":["Watermark triggers live on in models trained on AI data","AI data watermarks persist into downstream models","Over 90% success: watermarks survive fine-tuning","Tracking LLM data through trigger words and style shifts","Hidden markers in AI datasets resist fine-tuning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000223,"raw_usage":{"total_tokens":1503,"prompt_tokens":1035,"completion_tokens":468,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":651,"completion_tokens_details":{"reasoning_tokens":394}},"tokens_in":651,"tokens_out":468,"duration_ms":4869,"temperature":1.0,"reasoning_tokens":394,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:00:41.156940+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a watermarked generated dataset, run a cheap normalization pass that drops sentences containing the trigger word or style, removes the fixed rare tokens such as 'ikun' or 'personne2', and paraphrases or back-translates the rest; then fine-tune the downstream model and measure watermark success rate on marked test inputs. If WSR falls to the unwatermarked baseline while accuracy stays roughly constant, then the watermarks are not robust to ordinary data cleaning.","supporting_citations":[{"cited_title":"A Watermark for Large Language Models","cited_arxiv_id":null,"evidence_quote":"Supplies the green-red list token sampling and Z-score detection that the weak output-level watermark is built on."},{"cited_title":"Hidden Trigger Backdoor Attack on NLP Models via Linguistic Style Manipulation","cited_arxiv_id":null,"evidence_quote":"Supplies the style-as-trigger idea that the stylistic input-level watermark adapts to a no-intervention setting."},{"cited_title":"Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring","cited_arxiv_id":null,"evidence_quote":"Supplies the backdoor-trigger mechanism for model watermarking that the traditional input-level watermark extends."},{"cited_title":"BadNL: Backdoor Attacks Against NLP Models with Semantic-preserving Improvements","cited_arxiv_id":null,"evidence_quote":"Supplies semantic-preserving backdoor trigger injection for NLP, forming the basis of the trigger-based input watermark."}],"review_version":2}