{"id":"df40e901-46a4-427a-913b-028086645e5f","arxiv_id":"2607.21958","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A one-pass e-process detector for the Gumbel-max LLM watermark preserves anytime-valid Type I error control while accumulating evidence token by token.","lead":"This paper develops a one-pass, stop-anytime statistical test for detecting text produced by a watermarked LLM, updating a single evidence score as each token arrives. It gives an exact false-positive guarantee under optional stopping and shows fast detection on simulations and real LLM outputs.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Exp(1) pivot null in §3.2 is asserted rather than proved for the actual keyed reconstruction; if the key schedule leaks into the reduced filtration G_{t-1}, the anytime-valid Type I error guarantee can fail.","rationale":"I agree with the reader that the conditional pivot null Z_t | G_{t-1} ~ Exp(1) is the load-bearing step: Theorem 3.1 and all anytime-validity claims collapse if it fails. However, the reader's framing as a 'human text' problem is not quite precise. For any text generated independently of the watermark key, W_t is independent of U_t, so the key issue is not the provenance of the text but whether conditioning on past pivots can reveal enough about the key to distort the conditional law of future pivots. This is an implementation-dependent question about the key schedule, not an inherent property of human text. The paper does not address it, and Algorithm 1 omits the reconstruction details. The main e-process mathematics is otherwise standard and correct. I also note that Theorem 4.1's proof is absent from the supplied text, but the more fundamental and actionable concern is the pivot null. Since the reader already returned CONDITIONAL and this concern reinforces that conditionality rather than overturning the method, I recommend no change to the verdict.","tokens_in":11738,"tokens_out":15068,"duration_ms":170797,"concrete_test":"Simulate H0 with a concrete key schedule: fix a random key, generate a non-watermarked text (e.g., from an independent LLM or a human corpus), and at each step t reconstruct U_t using the same keyed PRF as the watermark (e.g., SHA-256(key, context, w) over the vocabulary). Compute Z_t = -log(1 - U_{t,W_t}) and test whether the empirical conditional distribution of Z_t given the previous pivots is Exp(1), e.g., via a KS or chi-square test on binned residuals. Then run the proposed stopping rule at α = 0.05 over many independent keys and record the empirical false-positive rate under optional stopping. If the false-positive rate exceeds 5% or the conditional law deviates from Exp(1), the pivot reduction fails. Repeat with U_t drawn fresh i.i.d. each step to confirm the theory is internally consistent when the independence assumption is enforced.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.2 reduces Gumbel-max watermark detection to the pivot Z_t = -log(1 - U_{t,W_t}) and asserts Z_t | G_{t-1} ~ Exp(1) under H0. This conditional pivot null is the load-bearing premise for Theorem 3.1: each factor (1-λ)e^{λZ_t} is a conditional e-value only if the Exp(1) law holds given the entire reduced history, not just marginally. The paper argues from W_t being independent of U_t, but in the actual watermarking scheme U_t is reconstructed from a secret key and the previous context. Conditioning on G_{t-1} = σ(Z_1,...,Z_{t-1}) can therefore transmit information about the key/PRF state into the distribution of future U_t. If the same keyed PRF is evaluated on successive contexts, the conditional law of U_{t,W_t} given G_{t-1} need not be Uniform; it could be a mixture or point mass, so the conditional expectation of the proposed one-step factor may differ from 1. The paper never proves the pivot null under the concrete key-reconstruction mechanism used by Algorithm 1. The reader's 'human text' concern is a special case of this broader issue: it is not human text per se that breaks the argument, but the possible dependence of the reconstructed U_t on information already present in the reduced filtration. If U_t is freshly sampled i.i.d. per token and independent of G_{t-1}, the theorem is sound; the gap is the missing bridge between that modeling assumption and the keyed hash/PRF implementation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an online, anytime-valid watermark detector for the Gumbel-max watermark, based on the reduced pivot Z_t = -log(1 - U_{t,W_t}). Under the null that Z_t | G_{t-1} ~ Exp(1), it constructs the e-process M_t(λ) = (1-λ)^t e^{λ S_t}, and adds plug-in and mixture versions of λ. The main theoretical claims are anytime-valid Type I error control via Theorem 3.1 and positive asymptotic log-growth under watermarking via Theorem 4.1. The method is O(1) memory and updates token by token (Algorithm 1). Experiments on synthetic spike-model data and on OPT-1.3B/GPT-Neo-1.3B text compare power, sequential Type I error, and runtime against online and offline baselines.","tokens_in":12116,"tokens_out":6430,"duration_ms":62373,"significance":"If the pivot null premise is valid, the construction is elegant and practically attractive: the one-step factors are genuine conditional e-values, the proof of Theorem 3.1 is a one-line MGF calculation, and the O(1) recursive update is a concrete improvement over history-dependent e-process baselines. The mixture and plug-in extensions are standard and valid under predictability. However, the paper's central reduction is asserted rather than proved for the actual keyed reconstruction, and the proof of the consistency theorem is deferred to an appendix that is absent from the manuscript. The significance for the sequential-testing/LLM-watermark community is therefore real but conditional on filling these gaps.","major_comments":[{"comment":"The load-bearing null premise, Z_t | G_{t-1} ~ Exp(1), is asserted but not proved for the keyed reconstruction. The argument says W_t is independent of U_t under H0; however, G_{t-1} = σ(Z_1,...,Z_{t-1}) contains functions of past keyed pseudorandom vectors, so it may carry information about the key/PRF state and future U_t. Under the concrete key schedule used in Algorithm 1, the conditional law of U_{t,W_t} given G_{t-1} is not shown to be Unif(0,1), nor is Z_t shown to be Exp(1). Since Theorem 3.1 and the anytime-valid Type I error claim depend on this conditional law (not just marginal independence), the paper needs either a proof under an explicit key/PRF model or a clearly stated additional assumption defining the null under which the guarantee holds.","section":"§3.2 and Algorithm 1"},{"comment":"The proof of Theorem 4.1 is not present; the text defers to an Appendix that is not included. The theorem is central to the consistency claim (positive asymptotic log-growth and a.s. rejection). As written, it is an unverified assertion. Please provide the proof, or state the theorem as a conjecture and adjust the claims. Also clarify whether the λ whose existence is asserted is a universal constant or can depend on the unknown NTP sequence/P_t; if the latter, the practical relevance of the existence result is limited.","section":"§4, Theorem 4.1"},{"comment":"The validity of the plug-in and mixture e-processes is stated to be proved in an absent Appendix. For the mixture this follows by convexity from Theorem 3.1, and for the plug-in it follows if λ_s is predictable and in (0,1); however, the clipping constants λ_min, λ_max are introduced without discussion of their effect on asymptotic log-growth, and Eq. (4)'s oracle λ* = 1 - μ^{-1} requires μ>1. Please include the deferred arguments and discuss the clipping/μ≤1 boundary case.","section":"§3.4, Eq. (5)-(6)"}],"minor_comments":[{"comment":"The label 'Rao-Blackwellized' is not justified as stated: Proposition 3.2 only shows that S_t is sufficient under the surrogate family and that M_t(λ) is a function of S_t. Please explain how Eq. (2) is obtained by Rao-Blackwellizing a full-data e-process, or soften the terminology.","section":"§3.3 / Proposition 3.2"},{"comment":"The unclipped oracle λ* = 1 - μ^{-1} is not in (0,1) unless μ>1. Please add this condition or explicitly define the maximizer over (0,1) for μ≤1.","section":"§3.4, Eq. (4)"},{"comment":"The term 'unwatermarking language model' is used repeatedly; it should be 'unwatermarked'. Also, the references to an Appendix should be resolved: the manuscript contains no appendix, so all 'Appendix states...' passages are currently unverifiable.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The paper has a solid core e-value calculation but overclaims the scope. The missing appendix and the unproved pivot null under a keyed PRF are the main barriers; both are fixable in revision. I do not see grounds for rejection, but acceptance would require the authors to either prove the conditional Exp(1) pivot under their Algorithm 1 or explicitly restrict all validity claims to the independent-fresh-randomization model."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this paper delivers a one-pass, anytime-valid e-process for Gumbel-max watermark detection. The core e-process M_t = (1-λ)^t e^{λ S_t} is the textbook likelihood-ratio e-process for Exp(1) observations, and Theorem 3.1 is a one-line conditional e-value argument. It is correct given the claimed pivot null Z_t | G_{t-1} ~ Exp(1). The plug-in and mixture variants are standard but useful. The genuinely new part is that the whole procedure needs only the current e-process value, so it is memory-free and supports optional stopping in streaming settings.\n\nWhat the paper does well: it clearly positions itself against Su et al. and Huang et al., it gives a clean algorithmic statement (Algorithm 1), and it does not oversell the mathematical innovation — except for the 'Rao-Blackwellized' in the title, which is not really earned. No conditioning or averaging is performed; the paper simply uses a sufficient statistic. That framing should be toned down.\n\nThe soft spots: (1) The pivot null is asserted, not proved, for the actual keyed reconstruction. Under H0 (unwatermarked LLM generation), if U_t is generated from the key and the previous context, then G_{t-1} can carry information about the context, and the conditional distribution of U_{t,W_t} given G_{t-1} need not be uniform. The paper's reduction requires the key schedule to produce conditionally i.i.d. uniforms given the reduced filtration. That is a load-bearing assumption for anytime-valid Type I error control, and it deserves a rigorous treatment. The stress-test note is right that this is a gap. (2) Theorem 4.1's proof is deferred to an omitted appendix, and the asymptotic log-growth claim is stated under stylized m-dependence assumptions. The appendix needs to be available for referees. (3) The experiments are suggestive but not reproducible: no code, no error bars, and the figures are missing from this version. Given that the method is simple, the experimental section is a minor part, but for a systems-style claim about efficiency, the runtime comparison should be backed by code.\n\nOverall: the central contribution is narrow but real — a memory-free online e-process for a specific watermark. If the pivot null can be justified under a realistic key schedule, the paper is correct and usable. As it stands, the missing proof is a genuine concern, but not a fatal one, because the assumption is explicit and verifiable. I would send it to peer review with a request to prove the pivot null, include the appendix, and release code.\n\nWho it's for: anyone working on watermark detection or anytime-valid inference for LLMs. A serious referee should engage with it.","headline":"A sound but incremental one-pass e-process for Gumbel-max watermark detection; the math checks out under a pivot assumption that needs a rigorous proof for keyed reconstruction.","tokens_in":12687,"tokens_out":5233,"would_cite":false,"duration_ms":52107,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62L10","62F03"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proves that a single pivot sequence, Z_t = -log(1-U_{t,W_t}), turns Gumbel-max watermark detection into a one-pass, anytime-valid sequential test.","keywords":["LLM watermarking","e-process","anytime-valid inference","sequential testing","Gumbel-max watermark","Rao-Blackwellization","online detection","optional stopping"],"falsifier":"Generate unwatermarked text by a sampling rule that makes the emitted token depend on the key-derived uniforms (for example, always pick the token with maximum U, or use a biased RNG), feed the pivots through the proposed stopping rule at α=0.05, and repeat many times. If the conditional distribution of Z_t genuinely departs from Exp(1), the empirical false-positive rate under optional stopping will exceed 5%, demonstrating that the anytime-valid guarantee depends on the independence premise.","tokens_in":11559,"feed_emoji":"🔍","tokens_out":5643,"duration_ms":52105,"temperature":0.7,"pith_summary":"The paper's goal is an online detector for LLM watermarking: one that reads tokens as they are generated and can declare 'watermarked' at any moment with a statistically guaranteed false-positive rate. It proves that for the Gumbel-max watermark, the sequence M_t(λ) = (1-λ)^t exp(λ S_t), built from the pivot Z_t = -log(1-U_{t,W_t}), is an e-process, meaning its running maximum has time-uniform Type I error control. That turns watermark detection into a one-pass sequential test with constant memory, valid under arbitrary optional stopping. The paper also proves that under watermarking the same process grows exponentially in expectation, so the test eventually rejects with probability one, and it provides plug-in and mixture versions that choose the tilt λ adaptively. A sympathetic reader would care because existing watermark tests are mostly fixed-horizon and become invalid if used with early stopping; this gives a rigorous streaming alternative.","feed_headline":"One-line memory test catches watermarked AI text as it streams","feed_subtitle":"Monitors tokens one by one and stops early without inflating false positives or storing the full text.","key_machinery":"The load-bearing object is the normalized exponential score E_t = (1-λ)e^{λ Z_t}, whose product forms the e-process M_t(λ) = (1-λ)^t e^{λ S_t}. The pivot Z_t = -log(1-U_{t,W_t}) is the mechanism that strips away the unknown next-token distribution: under the null it is Exp(1), and under watermarking larger values signal dependence. Rao-Blackwellization appears through the surrogate exponential-tilt family q_κ(z) = (1-κ)exp(-(1-κ)z), under which the cumulative sum S_t is a sufficient statistic, so inference depends only on the scalar S_t rather than the full token history.","core_discovery":"The central claim is that watermark detection reduces to testing whether a single pivot sequence behaves like standard exponential noise. For the Gumbel-max watermark, at each step the detector reconstructs the key-derived uniform U_{t,W_t} associated with the emitted token and forms Z_t = -log(1-U_{t,W_t}). The paper argues that under the null of no watermarking, Z_t is conditionally Exp(1) given the past pivots, so each one-step e-value (1-λ)exp(λ Z_t) has conditional expectation 1. Their product M_t(λ) is therefore an e-process, giving an anytime-valid level-α test via the stopping rule M_t ≥ 1/α. Under the Gumbel-max alternative, the paper proves positive asymptotic log-growth for a suit","pith_inferences":["The same pivot reduction could likely be built for green-red list watermarks if a pivot with an explicit null distribution can be defined, opening a general recipe for online detection.","A practical deployment could use the pivot's empirical distribution as a monitoring diagnostic: if the null assumption fails on human text, the detector would need recalibration before use.","Anytime-valid detection enables use cases where a decision must be made mid-generation, such as halting a chat model's output or flagging content before the full response is delivered.","A natural extension is to turn the e-process into a confidence sequence for watermark strength, giving an anytime estimate of how strong the watermark signal is, not just a binary rejection."],"forward_implications":["A detector can monitor a live token stream and stop the moment evidence crosses 1/α, with no correction for multiple looks.","Only a single accumulator M_t and the cumulative sum S_t need to be kept, so the method runs in constant memory per token.","The plug-in and mixture versions automatically adapt the tilt λ to the unknown signal strength while preserving validity.","Fixed-horizon watermark tests that reuse the same data for repeated testing lose Type I error control; this construction gives an online alternative.","Under watermarking, the test is consistent: it rejects almost surely as text length grows."],"fun_headline_variants":["Token-by-token watermark test stops early without full history","Anytime-valid detector flags AI text on the fly","Streaming LLM watermark test: no full text needed","Online e-process catches watermarks with early stopping","Rao-Blackwellized e-processes enable online watermark checks"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The entire false-positive guarantee hangs on the premise that, whenever text is not watermarked, the pivot Z_t = -log(1-U_{t,W_t}) has conditional Exp(1) distribution given the past; if tokens are selected with even a small dependence on the key-derived uniforms, the guarantee fails.","fun_headline_variants_meta":{"raw":{"variants":["Token-by-token watermark test stops early without full history","Anytime-valid detector flags AI text on the fly","Streaming LLM watermark test: no full text needed","Online e-process catches watermarks with early stopping","Rao-Blackwellized e-processes enable online watermark checks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000627,"raw_usage":{"total_tokens":2727,"prompt_tokens":721,"completion_tokens":2006,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":465,"completion_tokens_details":{"reasoning_tokens":1934}},"tokens_in":465,"tokens_out":2006,"duration_ms":16187,"temperature":1.0,"reasoning_tokens":1934,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T06:13:58.641983+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate unwatermarked text by a sampling rule that makes the emitted token depend on the key-derived uniforms (for example, always pick the token with maximum U, or use a biased RNG), feed the pivots through the proposed stopping rule at α=0.05, and repeat many times. If the conditional distribution of Z_t genuinely departs from Exp(1), the empirical false-positive rate under optional stopping will exceed 5%, demonstrating that the anytime-valid guarantee depends on the independence premise.","supporting_citations":[],"review_version":1}