{"id":"36c62ed1-1fbc-4414-ab45-72d16d733dee","arxiv_id":"2601.22985","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Steering the unmasking order of diffusion language models so that tokens at parity-matching positions get revealed first creates a detectable watermark with modest quality loss.","lead":"Discrete diffusion language models reveal text tokens in arbitrary order; this paper uses that order as a hidden signal, steering the unmasking sequence toward positions whose likely next tokens satisfy a parity rule. A detector then reads the elevated parity-match rate to tell machine-written text apart, with some resilience to rewriting and other edits.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Claimed FPR=0.000 is unvalidated: experiments use public token-ID parity (App. D.1), not a keyed PRF, and no human-text FPR is reported, so the Eq. (1) null may not hold.","rationale":"The paper's central claim depends on a valid null distribution for non-watermarked text. The authors themselves state in D.1 that experiments substitute token-ID parity for a cryptographically secure PRF. This is a limitation but not necessarily fatal: the failure mode is that the public parity hash can be correlated with token frequency, so human text may have parity-matching rate deviating from 1/2. Without a human-text FPR report, the tables' FPR=0.000 only says 'model non-watermarked outputs don't exceed threshold,' not 'human text doesn't.' A keyed PRF would restore the null and is compatible with the framework, so the fix is straightforward and the paper should remain conditional pending this calibration. This matches the reader's assessment; no verdict adjustment.","tokens_in":27350,"tokens_out":5136,"duration_ms":60736,"concrete_test":"Take human-authored samples from C4 and Writing Prompts (same length/domain as generated outputs), compute the parity-matching z-score using f(v)=token_id mod 2, and report FPR at z∈{4,5}. Then rerun detection with a keyed PRF hash f(v,ξ)=HMAC-SHA256(ξ,v) over both human and watermarked texts. If human FPR at z=4 remains ≤0.01 and TPR matches Table 2, the concern is resolved; if human FPR is inflated, Eq. (1)'s null is misspecified and the claimed error rates are not evidence of watermark detectability.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Eq. (1) declares watermarked when z exceeds a threshold, with null m_i ~ Bernoulli(1/2) justified only by f(·,ξ) being balanced and secret. Appendix D.1 states the experiments use f(v)=token_id mod 2, which is public and unbalanced in a way that depends on the tokenizer's arbitrary ID ordering. Tables 1 and 2 report FPR/TNR against non-watermarked model generations, not human-authored text. If common human tokens are non-uniformly distributed across token-ID parity (or correlate with position), the null mean departs from 1/2 and the reported FPR=0.000 is not a valid estimate for human inputs. Separately, a public f means an adversary can spoof or strip the signal. The core decoding-order mechanism is not internally inconsistent, and the elevated parity-matching rates on watermarked outputs are plausible; the missing piece is calibration of the detection null, which is required for the provenance claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"dgMARK is a watermarking method for discrete diffusion language models that embeds a signal by steering the order in which tokens are unmasked, rather than by reweighting token probabilities. A binary hash f(v, ξ) assigns a parity to each vocabulary token; at each decoding step the decoder restricts attention to positions whose sampled candidate token has parity matching the position index, selects the highest-reward such position (falling back to any position if none matches), and reveals that token. Detection counts parity matches and applies a z-test (Eq. 1), with a sliding-window variant for robustness to post-editing. The paper evaluates on LLaDA-8B/1.5/2.0 and Dream-7B over C4 and Writing Prompts, compares to KGW and PATTERN-MARK, and reports high detectability, modest perplexity increase, robustness to token edits and paraphrasing, and computational overhead. The experiments instantiate the hash as token-ID modulo 2 (Appendix D.1), although the design allows keyed PRFs.","tokens_in":27549,"tokens_out":9894,"duration_ms":117244,"significance":"The paper identifies a genuinely new watermark channel for dLLMs — the unmasking order — and provides broad empirical evidence: multiple model families, datasets, sampling strategies, quality benchmarks, robustness attacks, and overhead measurements. The beam-search lookahead variant and the attempt to avoid probability reweighting are useful contributions. The significance is conditional on resolving a calibration gap in the detection statistic: the experiments use a public, non-secret parity map, whereas the detection null and the security argument require a balanced, secret keyed hash. If the authors re-run with a keyed PRF and validate human-text false-positive rates, the contribution would be solid and timely.","major_comments":[{"comment":"Eq. (1) derives the Binomial(n,1/2) null from a balanced and secret f(·,ξ). Appendix D.1 states that all experiments use f(v)=token_ID mod 2, which is public and not necessarily balanced over the natural-token distribution. Any correlation between token-ID parity and token frequency shifts the null mean, so the FPR=0.000/TNR=1.000 values in Tables 1 and 2 are calibrated only on non-watermarked model outputs under this non-secret hash. They do not establish the behavior on human-authored text, and they do not transfer to the keyed-PRF scheme the paper says it supports. This is load-bearing for the provenance claim; please report parity balance of the tokenizer, human-text FPR, and preferably re-run detection with a keyed PRF.","section":"§3.5 (Eq. 1), Appendix D.1"},{"comment":"The sliding-window statistic zwin=(1/S)Σ z_s^2 is introduced without a null distribution or a threshold calibration. Figures 2–3 report ROC/AUC, but no fixed-FPR operating points are given under insertion, deletion, substitution, or paraphrasing. Because absolute-position parity is disrupted by insertions/deletions, the two-sided aggregation is heuristic, and it is not clear what false-positive rate corresponds to the advertised robustness. Please provide the null/calibration for zwin or report TPR/FPR at the chosen operating point for each attack budget.","section":"§3.5 (robust detection)"},{"comment":"The security claim is unverified: the paper argues that a keyed PRF would make the watermark resilient to adversarial reverse-engineering, but no experiments or analysis consider an adversary who knows the token-ID parity map used in the evaluation. Since embedding and detection use exactly the same public statistic, an adversary can forge or strip the watermark. Please state the threat model explicitly (secret vs. public f) and provide at least one adversarial evaluation for the PRF version, e.g., best-effort parity flipping or reordering.","section":"§3.3, Appendix D.1"}],"minor_comments":[{"comment":"First sentence in the main text reads \"We proposedgMARK\"; should be \"We propose dgMARK\".","section":"Abstract"},{"comment":"The denominator appears as \"p n/4\"; it should be sqrt(n/4).","section":"Eq. (1)"},{"comment":"Please clarify in the captions that FPR/TNR are computed on non-watermarked dLLM outputs at z=4.0, not on human-authored text.","section":"Tables 1–2"},{"comment":"Some cells appear internally inconsistent; e.g., Table 9 with +5-beam at z=4.0 lists TPR=0.987 and FNR=0.127, which do not sum to 1. Please double-check all error-rate columns.","section":"Tables 9–10"},{"comment":"The stacked-bar labels are difficult to read; adding a legend or text annotations would improve clarity.","section":"Figure 15"}],"recommendation":"major_revision","confidential_remarks":"The main hurdle is the detection-null calibration: the paper's own Appendix D.1 admits that the experiments use token-ID parity rather than a keyed PRF, so the reported FPR=0.000 is not yet a valid estimate for human text or for the claimed keyed scheme. This is fixable within the manuscript's scope by re-running with a keyed PRF and reporting human-text false positives. The paper is otherwise well organized and the core idea is plausible; I would support acceptance after these experiments and a tightened threat-model discussion."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing you should know: this is the first dLLM watermark I've seen that really does use the unmasking order as the channel, not token probabilities. The core trick is simple — at each step, only consider unrevealed positions whose sampled candidate token has parity matching the position index, pick the highest-reward match; if none, fall back. With a one-step lookahead beam variant. Detection counts parity matches. That is genuinely new relative to the cited concurrent work, and the idea is well motivated by the order-sensitivity of practical masked diffusion models. The paper is honest that this channel only exists because models are not order-invariant; if a future dLLM learned all conditionals perfectly the watermark would vanish.\n\nThe experiments are broad: LLaDA, LLaDA 1.5, LLaDA 2.0, Dream, C4 and Writing Prompts, comparisons to KGW and PATTERN-MARK, robustness to insertion/deletion/substitution and DIPPER/Llama paraphrasing. Quality degradation is consistently smaller than the probability-reweighting baselines, and the beam variant pushes detectability to 100% TPR in several settings. I believe the elevated parity-match rates are real; the mechanism forces them.\n\nThe soft spot is the detection null. The theory in Eq. (1) says that under a balanced, secret hash, parity matches are Bernoulli(1/2) and z is standard normal. In the experiments, f is token-ID modulo 2 — public, and almost certainly not balanced with respect to natural text. The paper reports FPR=0.000, but that is measured against non-watermarked model generations, not human-authored text. If common human tokens correlate with token-ID parity, the true FPR against human text is not zero and could be substantial. The authors note in Appendix D.1 that a PRF can be plugged in, but until the experiments actually use a keyed f, or report the human-text FPR under the modulo hash, the stated FPR numbers are not calibration. There is also no code or seeds, and the main detectability tables use length-filtered outputs, which inflates TPR; the length sweep in Fig. 4 mitigates this but doesn't fully fix it.\n\nNone of this kills the underlying idea. The mechanism is well-defined, the comparisons are informative, and the assumptions are mostly stated. But the paper needs a revision that either instantiates the keyed PRF or re-baselines detection on human text. I'd send it to review — a serious referee will catch the same things and the method is worth engaging with.","headline":"Decoding-order watermarking for dLLMs is a real new idea, and the experiments are broad; but the reported FPR=0.000 rests on a token-ID parity hash that does not justify the theoretical null.","tokens_in":28062,"tokens_out":2266,"would_cite":true,"duration_ms":24000,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Watermarking for diffusion language models can be embedded by steering the order in which tokens are unmasked, not by biasing token probabilities.","keywords":["watermarking","diffusion language models","decoding order","masked diffusion","parity hash","text provenance","sliding-window detection","discrete diffusion"],"falsifier":"Run dgMARK on a dLLM trained to be fully order-invariant (e.g., by averaging over all unmasking permutations during training); if the parity-matching rate no longer rises above 0.5, the watermark channel disappears. Alternatively, generate text with the token-ID modulo 2 hash but without a secret key and compute the empirical z-score distribution on many sequences: if it deviates from a standard normal, the detection null is mis-specified and the false-positive claims do not hold as stated.","tokens_in":27182,"feed_emoji":"🛡️","tokens_out":2857,"duration_ms":32545,"temperature":0.7,"pith_summary":"Discrete diffusion language models generate text by iteratively unmasking tokens, and although an ideal model would be indifferent to the unmasking order, practical dLLMs are sensitive to it. dgMARK exploits this sensitivity to embed a watermark: instead of reweighting token probabilities like prior schemes, it guides which position is revealed next, prioritizing positions whose candidate token satisfies a parity constraint tied to the position index. This raises the fraction of parity-matching tokens above the chance level of 0.5, providing a statistical signal that can be detected with a secret key and without access to model internals. The paper argues that this yields strong detectability with smaller text-quality degradation than probability-biasing baselines, and that a sliding-window detector makes it robust to post-editing. If correct, it establishes decoding order itself as a viable watermark channel for dLLMs.","feed_headline":"Decoding order carries the watermark in diffusion LLMs","feed_subtitle":"dgMARK hides a parity signal in the unmasking sequence, not in token probabilities, and detects it without model internals.","key_machinery":"The central mechanism is the binary parity hash f: V × Ξ → {0,1} that partitions the vocabulary into parity-matching sets G_i, combined with a decoding algorithm that prioritizes positions whose candidate token lies in G_i. The hash is the carrier of the watermark signal: its balance gives the binomial null (Parity matches ~ Binomial(n, 1/2)), and its secrecy prevents easy spoofing. The one-step lookahead beam search computes, for each top candidate, how many future positions would remain parity-matching after committing, making the embedding stronger while adding computation.","core_discovery":"The paper claims that the decoding order of a dLLM can serve as a watermark channel. In dgMARK, at each step the decoder restricts attention to unrevealed positions whose sampled candidate token falls in the parity-matching set G_j = {v : f(v, ξ) ≡ j mod 2}, where f is a balanced binary hash keyed by a secret ξ, and selects the highest-reward position among those, falling back to the full set when no match exists. This simple rule systematically elevates the parity-matching rate of generated tokens, so detection reduces to a z-test on whether the observed rate significantly exceeds 0.5. The paper also introduces a one-step lookahead beam variant that preserves future parity-alignment opportu","pith_inferences":["Because dgMARK's signal relies on the gap between ideal order-invariance and practical order-sensitivity, its reliability may weaken as dLLMs become better trained and more order-invariant; the method's long-term viability depends on whether that sensitivity persists in future models.","The experiments instantiate the hash as token-ID modulo 2, which is not secret and may correlate with token frequencies, so the paper's detection null (parity matches ~ Binomial(n, 1/2)) is a theoretical ideal rather than a verified property of the actual test; using a true cryptographic PRF would close this gap but was not empirically tested.","dgMARK could likely be extended to carry multi-bit payloads (e.g., by using more than one parity class or by keying the hash to the prompt), enabling richer provenance metadata than a single binary watermark bit.","An attacker who reorders or rephrases text to restore parity balance might evade the sliding-window detector; since the watermark lives in token positions, adversarial re-sorting attacks are a natural threat model worth testing."],"forward_implications":["Decoding order is a practical watermark channel for dLLMs, complementary to probability-biasing methods, and can be combined with common decoding strategies such as confidence, entropy, and margin-based ordering.","Watermark detection only needs the generated text and the secret key, not the model's internals or the prompt, making it suitable for provenance verification in deployed systems.","The one-step lookahead variant provides a tunable trade-off between detectability, text quality, and computational cost, with beam sizes of 3-8 yielding near-perfect detection at low false-positive rates.","The sliding-window detector extends the watermark's robustness to post-editing, including random insertions, deletions, substitutions, and paraphrasing, so it can survive common text transformations.","Longer generations (around 200 tokens or more) are particularly amenable to dgMARK, suggesting practical use in summaries, reports, and stories, while very short outputs would need aggregation or a less stringent detection threshold."],"fun_headline_variants":["Watermarking diffusion LLMs via unmasking order","dgMARK: hiding watermarks in the decoding order of diffusion models","Parity in unmasking order watermarks diffusion LLMs without reweighting","No probability reweighting: diffusion watermark rides decoding order","Unmasking order is the new channel for watermarking diffusion LLMs"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The scheme bets that real dLLMs are sensitive enough to the unmasking order that steering which position is revealed next can shift token statistics without visibly harming text quality, and that the parity hash is balanced and secret enough for the binomial null to hold.","fun_headline_variants_meta":{"raw":{"variants":["Watermarking diffusion LLMs via unmasking order","dgMARK: hiding watermarks in the decoding order of diffusion models","Parity in unmasking order watermarks diffusion LLMs without reweighting","No probability reweighting: diffusion watermark rides decoding order","Unmasking order is the new channel for watermarking diffusion LLMs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000792,"raw_usage":{"total_tokens":3306,"prompt_tokens":707,"completion_tokens":2599,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":451,"completion_tokens_details":{"reasoning_tokens":2510}},"tokens_in":451,"tokens_out":2599,"duration_ms":21651,"temperature":1.0,"reasoning_tokens":2510,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T06:17:05.961053+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run dgMARK on a dLLM trained to be fully order-invariant (e.g., by averaging over all unmasking permutations during training); if the parity-matching rate no longer rises above 0.5, the watermark channel disappears. Alternatively, generate text with the token-ID modulo 2 hash but without a secret key and compute the empirical z-score distribution on many sequences: if it deviates from a standard normal, the detection null is mis-specified and the false-positive claims do not hold as stated.","supporting_citations":[],"review_version":1}