arxiv: 2602.01752 · v2 · submitted 2026-02-02 · 💻 cs.CL · cs.CR

Recognition: 2 theorem links

· Lean Theorem

WorldCup Sampling for Multi-bit LLM Watermarking

Yidan Wang , Yubing Ren , Yanan Cao , Li Guo

Authors on Pith no claims yet

Pith reviewed 2026-05-16 08:32 UTC · model grok-4.3

classification 💻 cs.CL cs.CR

keywords multi-bit watermarkingLLM text watermarkingsampling-based embeddinghierarchical competitionentropy-aware modulationconfidence-aware decodingprovenance encodingrobust message recovery

0 comments

The pith

WorldCup embeds multi-bit messages into LLM text by modeling token sampling as a communication channel with hierarchical competitions and entropy-aware modulation.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper presents WorldCup as a multi-bit watermarking scheme that treats the LLM sampling process as a structured channel for carrying provenance information beyond simple detection. Bits are embedded through successive competitions between token candidates guided by complementary signals, with entropy-aware adjustments to limit quality loss. Robust recovery happens via confidence-aware decoding that weighs token reliability during extraction. This setup targets a practical tradeoff among payload size, detectability, resistance to edits, output naturalness, and speed. Experiments position it ahead of prior extensions of zero-bit methods on these combined dimensions.

Core claim

WorldCup models the sampling process as a structured communication channel and embeds message bits through a hierarchical competition mechanism guided by complementary signals, while entropy-aware modulation preserves generation quality and confidence-aware decoding supports robust recovery of the full message.

What carries the argument

Hierarchical competition mechanism guided by complementary signals, which structures token selection to encode bits while maintaining probability distributions.

If this is right

LLM providers can attach richer metadata such as model version or session identifiers to generated text.
Detection systems gain the ability to extract full provenance strings rather than binary presence flags.
Watermarked text remains usable in downstream applications without noticeable degradation.
Decoding stays efficient even as message length grows because it accounts for per-token reliability.
The channel view of sampling opens a route to systematic capacity increases without ad-hoc logit tweaks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Similar competition structures could be adapted to watermarking in other autoregressive generators such as image or audio models.
Integration with existing zero-bit detectors could create a two-layer attribution pipeline for high-stakes uses.
Longer generations might support even higher bit rates if entropy modulation scales with context length.
Adversarial paraphrasing attacks would serve as a direct stress test of the robustness claims.

Load-bearing premise

The hierarchical competition plus entropy modulation can insert multiple bits without measurably harming text quality or making recovery unreliable under typical perturbations.

What would settle it

A controlled test showing that raising the bit payload above prior methods produces statistically significant drops in human preference scores or increases in perplexity compared with unmodified generation.

Figures

Figures reproduced from arXiv: 2602.01752 by Li Guo, Yanan Cao, Yidan Wang, Yubing Ren.

**Figure 1.** Figure 1: An overview of our multi-bit watermarking framework WorldCup for large language models. corresponding subset is designated as the green list and is assigned a positive logits bias δ. This bias increases the likelihood that LLM samples tokens from the designated subset, thereby embedding the message symbol during generation. Message Decoding. MPAC extracts the embedded multibit messages from text via a ma… view at source ↗

**Figure 2.** Figure 2: provides a visualization of this effect. Compared with independently sampled (random) g-value functions, complementary g-values exhibit a strict linear relationship, making the two message states (0 and 1) substantially easier to distinguish. This observation motivates the following proposition, which formalizes the optimality of complementary g-value functions in the multi-bit watermarking setting. Propo… view at source ↗

**Figure 3.** Figure 3: The comparison of multi-bit message decoding. as confidence scores indicating whether the j-th bit of the 2 k -ary message symbol at position p favors 0 or 1. 3) Extracting message symbols. For each message position p, we independently infer the j-th bit of the embedded symbol by comparing s p j and s¯ p j . The recovered 2 k -ray message symbol mˆ p ∈ {0, . . . , 2 k − 1} is then obtained as mˆ p = X k j… view at source ↗

**Figure 4.** Figure 4: The AUROC curves under different attacks on LLaMA3. tently outperforms existing watermarking methods across a variety of attack scenarios, achieving higher AUC scores and decoding accuracy. In the six attack scenarios illustrated in [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

**Figure 5.** Figure 5: The ablation study of WorldCup (k = 2) on LLaMA3. the distribution induced by k groups of g-value functions, we perform a component-wise ablation study. We evaluate three variants: (i) removing the entropy-aware dynamic adjustment factor λ (WorldCup w/o entropy, i.e., q − q¯); (ii) disabling the subtraction of complementary g-value distributions (WorldCup w/o minus, i.e., q); and (iii) replacing compleme… view at source ↗

**Figure 7.** Figure 7: The comparison of PPL across different multi-bit watermarking methods on LLaMA3-8B and Gemma2-9B. The numerical results corresponding to [PITH_FULL_IMAGE:figures/full_fig_p021_7.png] view at source ↗

**Figure 8.** Figure 8: The AUROC curves under different attacks on LLaMA3-8B-Base model (16 bits). 0.0 0.2 0.4 0.6 0.8 1.0 False Positive Rate (FPR) 0.0 0.2 0.4 0.6 0.8 1.0 True Positive Rate (TPR) Word-D (ratio=0.2) BiMark (Bit Acc: 0.878) SegMark (Bit Acc: 0.819) MPAC (Bit Acc: 0.860) WorldCup (k = 1) (Bit Acc: 0.868) WorldCup (k = 2) (Bit Acc: 0.902) Random 0.0 0.2 0.4 0.6 0.8 1.0 False Positive Rate (FPR) 0.0 0.2 0.4 0.6 0.8… view at source ↗

**Figure 9.** Figure 9: The AUROC curves under different attacks on Gemma2-9B-Base model (16 bits) [PITH_FULL_IMAGE:figures/full_fig_p022_9.png] view at source ↗

**Figure 10.** Figure 10: The comparison of spike entropy between LLaMA3-8B-Base and Gemma2-9B-Base across different message bits I.2. Distortionary and Non-distortionary g-value Functions According to SynthID (Dathathri et al., 2024), we define distortionary and non-distortionary g-value functions as follows: Definition I.1. A sampling algorithm S : ∆V ×R → V is (single-token) non-distortionary if for any probability distribution… view at source ↗

**Figure 11.** Figure 11: The comparison of distortionary and non-distortionary g-value functions I.3. Different Detectors Following SynthID Text (Dathathri et al., 2024), we consider two watermark detectors: mean detector (D1) and weightedmean detector (D2). The mean detector computes the average g-value across all tokens and all layers as MeanScore(x) := 1 mT X T t=1 Xm ℓ=1 gt,ℓ, (36) where T denotes the number of tokens and m … view at source ↗

**Figure 12.** Figure 12: The comparison of mean detector and weighted mean detector. I.4. WorldCup Sampling Layers To investigate the impact of the number of layers in WorldCup, we conducted experiments with different layer counts m = 5, 10, 20, 30, 50 on LLaMA3-8B-Base and Gemma2-9B-Base, with results summarized in [PITH_FULL_IMAGE:figures/full_fig_p025_12.png] view at source ↗

read the original abstract

As large language models (LLMs) generate increasingly human-like text, watermarking has emerged as a promising solution for reliable attribution beyond mere detection. While multi-bit watermarking enables richer provenance encoding, existing approaches typically extend zero-bit watermarking schemes by introducing static logit perturbations and counting-based decoding strategies, which can degrade text quality and compromise decoding robustness as the payload increases. In this paper, we propose WorldCup, a multi-bit watermarking framework for LLMs that models the sampling process as a structured communication channel and embeds message bits through a hierarchical competition mechanism guided by complementary signals. Moreover, WorldCup incorporates entropy-aware modulation to preserve generation quality and enables robust message recovery via confidence-aware decoding that accounts for token-level reliability. Comprehensive experiments demonstrate that WorldCup achieves a strong balance across message capacity, detectability, robustness, text quality, and decoding efficiency, consistently outperforming prior baselines. We believe that this work establishes a scalable and principled foundation for future research on multi-bit watermarking in LLMs.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

WorldCup offers a coherent new framework for multi-bit LLM watermarking via hierarchical competition that could improve the trade-offs in capacity and quality.

read the letter

The punchline here is that WorldCup presents a hierarchical competition mechanism for embedding multi-bit watermarks in LLMs, using entropy-aware modulation and confidence-aware decoding to maintain quality and robustness. This stands out from the static logit perturbations used in earlier multi-bit attempts. What the paper does well is frame the sampling process as a structured channel, which allows for more principled embedding. The complementary signals and token-level reliability in decoding address some of the robustness issues that come with higher payloads. If the comprehensive experiments hold, it achieves a good balance across the key metrics. Soft spots are mostly in the details not visible at this level. The outperformance is asserted but without specifics on controls or statistical significance, it's worth verifying in the full text. No load-bearing assumptions seem flawed based on the description, though. This is relevant for the AI security community, particularly those focused on provenance and attribution for generated content. A reader in that area would get value from the new sampling model and could adapt the ideas. It deserves a serious referee because the framework is novel enough and the problem is important.

Referee Report

2 major / 2 minor

Summary. The manuscript introduces WorldCup, a multi-bit watermarking framework for LLMs that models the sampling process as a structured communication channel. Message bits are embedded via a hierarchical competition mechanism guided by complementary signals, with entropy-aware modulation to preserve generation quality and confidence-aware decoding for robust recovery. Comprehensive experiments are claimed to demonstrate a strong balance across message capacity, detectability, robustness, text quality, and decoding efficiency, with consistent outperformance over prior baselines.

Significance. If the experimental results hold, this work provides a principled channel-modeling approach to multi-bit LLM watermarking that addresses quality and robustness trade-offs in existing methods, offering a scalable foundation for provenance encoding in generated text.

major comments (2)

§4.1: The hierarchical competition mechanism needs explicit analysis showing that complementary signals remain sufficiently independent to avoid introducing sampling bias, as any correlation would undermine the claimed robustness of multi-bit embedding.
§5.2, Table 3: The outperformance claims lack reported statistical significance tests or variance across multiple runs; without these, it is unclear whether the balance across metrics is reliably superior to baselines.

minor comments (2)

Abstract: The closing sentence 'We believe that this work establishes...' is opinionated and should be revised to a factual summary of contributions.
§3: Notation for entropy-aware modulation is introduced without a clear reference to the exact equation defining the modulation strength parameter.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the positive recommendation of minor revision and the constructive comments. We address each point below and will update the manuscript accordingly to strengthen the presentation of our results.

read point-by-point responses

Referee: §4.1: The hierarchical competition mechanism needs explicit analysis showing that complementary signals remain sufficiently independent to avoid introducing sampling bias, as any correlation would undermine the claimed robustness of multi-bit embedding.

Authors: We agree that an explicit analysis of signal independence is valuable for supporting the robustness claims. In the revised manuscript we will expand §4.1 with a dedicated paragraph providing both a theoretical argument (showing that the entropy-aware modulation constructs signals whose expected correlation is zero under the channel model) and empirical measurements (pairwise correlation coefficients computed on the same evaluation datasets used in §5). These additions will confirm that any residual dependence is negligible and does not compromise multi-bit recovery. revision: yes
Referee: §5.2, Table 3: The outperformance claims lack reported statistical significance tests or variance across multiple runs; without these, it is unclear whether the balance across metrics is reliably superior to baselines.

Authors: We acknowledge the importance of statistical rigor. The revised version will augment Table 3 with standard deviations computed over five independent runs (different random seeds) for every metric and will include p-values from paired Wilcoxon signed-rank tests comparing WorldCup against each baseline. These additions will substantiate that the reported improvements are statistically reliable. revision: yes

Circularity Check

0 steps flagged

No significant circularity detected in derivation chain

full rationale

The paper introduces WorldCup as a new multi-bit watermarking framework that models LLM sampling explicitly as a structured communication channel, using a hierarchical competition mechanism with complementary signals, entropy-aware modulation for quality preservation, and confidence-aware decoding for recovery. No equations, derivations, or predictions are presented in the abstract or described framework that reduce by construction to fitted parameters, self-definitions, or prior self-citations. The central claims rest on experimental outperformance rather than tautological renaming or imported uniqueness theorems. This constitutes an independent modeling approach with no load-bearing circular steps.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Based solely on abstract; no explicit free parameters, axioms, or invented entities are stated or extractable.

pith-pipeline@v0.9.0 · 5471 in / 948 out tokens · 67375 ms · 2026-05-16T08:32:36.735213+00:00 · methodology

discussion (0)

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

IndisputableMonolith/Cost/FunctionalEquation.lean washburn_uniqueness_aczel unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

we treat the sampling step itself as a natural communication channel and embed bits directly into token selection... complementary g-value functions... entropy-aware dynamic adjustment factor λ=α·σ(∑−PΘlogPΘ)
IndisputableMonolith/Foundation/BranchSelection.lean branch_selection unclear

?

unclear
Relation between the paper passage and the cited Recognition theorem.

complementary construction induces perfect anti-correlation... maximizes the decision margin

What do these tags mean?

matches: The paper's claim is directly supported by a theorem in the formal canon.
supports: The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends: The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses: The paper appears to rely on the theorem as machinery.
contradicts: The paper's claim conflicts with a theorem or certificate in the canon.
unclear: Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

19 extracted references · 19 canonical work pages · 2 internal anchors

[1]

ISBN 979-8-89176-251-0

Association for Computational Linguistics. ISBN 979-8-89176-251-0. doi: 10.18653/v1/2025.acl-long

work page doi:10.18653/v1/2025.acl-long 2025
[2]

Training Verifiers to Solve Math Word Problems

URL https://aclanthology.org/2025. acl-long.1005/. Chiang, W.-L., Li, Z., Lin, Z., Sheng, Y ., Wu, Z., Zhang, H., Zheng, L., Zhuang, S., Zhuang, Y ., Gonzalez, J. E., Stoica, I., and Xing, E. P. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, March 2023. URL https://lmsys.org/blog/ 2023-03-30-vicuna/. Cobbe, K., Kosaraju, V ., B...

work page internal anchor Pith review Pith/arXiv arXiv doi:10.18653/v1/n19-1423 2025
[3]

LitSearch: A retrieval benchmark for scientific literature search

URL https://aclanthology.org/2024. naacl-long.226/. Hou, A., Zhang, J., Wang, Y ., Khashabi, D., and He, T. k-SemStamp: A clustering-based semantic watermark for detection of machine-generated text. In Ku, L.-W., Mar- tins, A., and Srikumar, V . (eds.),Findings of the Associa- tion for Computational Linguistics: ACL 2024, pp. 1706– 1715, Bangkok, Thailand...

work page doi:10.18653/v1/2024 2024
[4]

Is llm-as- a-judge robust? investigating universal adversarial attacks on zero-shot llm assessment

URL https://proceedings.mlr.press/ v202/kirchenbauer23a.html. Kirchenbauer, J., Geiping, J., Wen, Y ., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., and Goldstein, T. On the reliability of watermarks for large language models. InThe Twelfth International Confer- ence on Learning Representations, 2024. URL https: //openreview.net/...

work page doi:10.18653/v1/2024.emnlp-main 2024
[5]

emnlp-main.1138/

URL https://aclanthology.org/2024. emnlp-main.1138/. Lee, T., Hong, S., Ahn, J., Hong, I., Lee, H., Yun, S., Shin, J., and Kim, G. Who wrote this code? watermarking for code generation. In Ku, L.-W., Martins, A., and Srikumar, V . (eds.),Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers), pp. 4...

work page doi:10.18653/v1/2024.acl-long.268 2024
[6]

Large Language Model Agent: A Survey on Methodology, Applications and Challenges

URL https://aclanthology.org/2024. acl-long.630/. Luo, J., Zhang, W., Yuan, Y ., Zhao, Y ., Yang, J., Gu, Y ., Wu, B., Chen, B., Qiao, Z., Long, Q., et al. Large language model agent: A survey on methodology, applications and challenges.arXiv preprint arXiv:2503.21460, 2025. Merity, S., Xiong, C., Bradbury, J., and Socher, R. Pointer sentinel mixture mode...

work page internal anchor Pith review Pith/arXiv arXiv doi:10.18653/v1/d19-1410 2024
[7]

Wang, Y ., Ren, Y ., Cao, Y ., and Fang, B

URL https://openreview.net/forum? id=JYu5Flqm9D. Wang, Y ., Ren, Y ., Cao, Y ., and Fang, B. From trade-off to synergy: A versatile symbiotic watermarking frame- work for large language models. In Che, W., Nabende, J., Shutova, E., and Pilehvar, M. T. (eds.),Proceed- ings of the 63rd Annual Meeting of the Association for Computational Linguistics (V olume...

work page 2025
[8]

URL https: //aclanthology.org/2025.acl-long.509/

doi: 10.18653/v1/2025.acl-long.509. URL https: //aclanthology.org/2025.acl-long.509/. Wu, Y ., Hu, Z., Zhang, H., and Huang, H. Dipmark: A stealthy, efficient and resilient watermark for large lan- guage models. 2023. Xu, X., Jia, J., Yao, Y ., Liu, Y ., and Li, H. Robust multi-bit text watermark with LLM-based paraphrasers. InF orty- second International...

work page doi:10.18653/v1/2025.acl-long.509 2025
[9]

Yoo, K., Ahn, W., and Kwak, N

URL https://openreview.net/forum? id=DVjkling5x. Yoo, K., Ahn, W., and Kwak, N. Advancing beyond identification: Multi-bit watermark for large language models. In Duh, K., Gomez, H., and Bethard, S. (eds.),Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies (V olu...

work page doi:10.18653/v1/2024.naacl-long 2024
[10]

naacl-long.224/

URL https://aclanthology.org/2024. naacl-long.224/. Yu, Z., Jiang, X., Gu, W., Wang, Y ., Wen, Q., Zhang, S., and Ye, W. SAEMark: Steering personalized mul- tilingual LLM watermarks with sparse autoencoders. InThe Thirty-ninth Annual Conference on Neural In- formation Processing Systems, 2025. URL https: //openreview.net/forum?id=tXnyVPNOfa. Zamir, O. Exc...

work page arXiv 2024
[11]

Explain Like I’m Five

URL https://openreview.net/forum? id=SsmT8aO45L. Zheng, L., Chiang, W.-L., Sheng, Y ., Zhuang, S., Wu, Z., Zhuang, Y ., Lin, Z., Li, Z., Li, D., Xing, E., et al. Judging llm-as-a-judge with mt-bench and chatbot arena.Ad- vances in neural information processing systems, 36: 46595–46623, 2023. 12 WorldCup Sampling for Multi-bit LLM Watermarking A. Related W...

work page 2023
[12]

Fluency (Naturalness): How natural, grammatical, and readable the candidate text is

work page
[13]

Adequacy: How well the candidate preserves the meaning of the reference

work page
[14]

Coherence: How logically consistent and well-structured the candidate text is

work page
[15]

Relevance: How well the content matches the intent and key information of the reference

work page
[16]

Scoring: - For each criterion, assign a score from 1 to 10

Style Consistency: How closely the candidate matches the tone and style of the reference. Scoring: - For each criterion, assign a score from 1 to 10. - Compute the final score as the average of all criterion scores. - Output ONLY the final numerical score (e.g., 3.8). Do not explain, justify, or output intermediate scores. Reference Text: xxx Candidate Te...

work page 2024
[17]

• Word-S-BERT (ratio = ρ): Randomly substitutes a proportion ρ of words with context-aware synonyms generated by a BERT-based (Devlin et al., 2019) model

lexical dictionary. • Word-S-BERT (ratio = ρ): Randomly substitutes a proportion ρ of words with context-aware synonyms generated by a BERT-based (Devlin et al., 2019) model. • Copy–Paste (n−ρ ): Randomly splits the watermarked text into n segments and inserts them into non-watermarked text, such that the inserted non-watermarked content accounts for a to...

work page 2019
[18]

Rewriting Eq

+E(G 2 0)−2E[G 1G0](14) Letµ i =E[G i]andσ 2 i = Var(Gi)fori∈0,1. Rewriting Eq. 14 in mean–variance form gives D=σ 2 1 +σ 2 0 −2 Cov(G1,G 0) +(µ1 −µ 0)2 (15) Under the identical-marginal assumption (µ0 =µ 1 =µ,σ 2 0 =σ 2 1 =σ 2), Eq. 15 simplifies to D= 2σ 2 −2 Cov(G1, G0)(16) For fixed marginals, D is maximized by minimizing the covariance between G0 and...

work page arXiv 2024
[19]

Please note that we do not typically admit for Spring or Summer admission

If your application is not Natural Text (C4 Dataset) received by then, it may not be evaluated. Please note that we do not typically admit for Spring or Summer admission. Offers are usually made between February and April 15. All applicants are considered for department support via research assistantships, teachings assistantships, and merit-based scholar...

work page 2018