Synchronization-Free Algebraic Fingerprints for Large Language Models: From Autoregressive to Diffusion Models

Jaroslaw Janas; Josef Pieprzyk; Pawel Morawiecki

REVIEW 5 major objections 5 minor 22 references

Synchronization-Free Algebraic Fingerprints for Large Language Models: From Autoregressive to Diffusion Models

T0 review · 5 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Every watermark bit is a self-contained parity constraint, so LLM text can be attributed without any token alignment.

desk verdict Novel sync-free watermark construction, but the central recovery guarantee is built on a false parity-balance assumption. read the letter →

arxiv 2607.16648 v1 pith:BFY262O5 submitted 2026-07-18 cs.CR cs.ITmath.IT

Jaroslaw Janas , Josef Pieprzyk , Pawel Morawiecki This is my paper · ORCID

classification cs.CRcs.ITmath.IT

keywords LLMwatermarkingsynchronization-freeReed-Solomoncodesbinaryfingerprintparityevaluationsymmetricchanneldiffusionlanguagemodelstextattribution

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that LLM-generated text can carry a reliable, attribution-ready watermark without any positional synchronization between embedding and detection. The construction makes every watermark bit a parity value of a Reed-Solomon polynomial at a point chosen by a keyed hash of the preceding token, so each bit is local and self-contained. The central claim is that recovering the embedded identity needs only n+λ intact token pairs, with failure probability below 2^{-λ}, regardless of where those pairs sit in the edited text. The authors argue that all editing damage—insertion, deletion, substitution, reordering—collapses into a binary symmetric channel, so robustness becomes a binomial tail problem. If true, this would give a practical, parameter-light watermarking method for both autoregressive and diffusion text generators.

What carries the argument

The engine is the algebraic fingerprint φ_S(α)=f_S(α) mod 2, where f_S is a degree-(n-1) polynomial over an odd prime field representing the secret identity. A keyed cryptographic hash maps each token pair to an evaluation point α, so every watermark bit is an independent binary constraint. Recovery is not classical Reed-Solomon decoding—the receiver sees only parities, not field elements—so the identity is reconstructed by exhaustive search, meet-in-the-middle, or fragmentation into short independently recoverable segments. In the diffusion-model extension, the same pairwise congruence becomes a local commitment rule; the paper analyzes three commit algorithms (basic, refined, sliding) with

What would settle it

Compute the agreement rate for the two identities S=0 and T=x over F_q using the paper's parity definition φ_S(α)=f_S(α) mod 2. For S=0, φ_S(α)=0 for all α; for T=x, φ_T(α)=α mod 2, which is 0 on all even α and 1 on odd α. Over a field of odd size q, the two fingerprints agree on (q+1)/2 points, not q/2, so the agreement probability is (q+1)/(2q)>1/2. Measuring this directly for any odd q, or running the paper's recovery experiment at m=n+λ for such a pair and observing failure probabilities larger than 2^{-λ}, would falsify the claimed bound.

Watch

Extended reading notes

Core claim

The paper's central discovery is that a binary fingerprint defined by parity evaluations of an identity-representing polynomial can serve as a synchronization-free watermark. For an n-bit secret identity, build polynomial f_S over F_q and define φ_S(α)=f_S(α) mod 2. In each token pair, hash the first token with the secret key to pick α; the parity value is the bit to be embedded in the second token. The receiver collects such pairs in any order and solves for the unique polynomial matching all observed parities. The key quantitative claim is Theorem 1: with m=n+λ observations, unique recovery fails with probability at most 2^{-λ} under the assumption that any two distinct identities agree on

Load-bearing premise

The whole probability-of-recovery result rests on Assumption 1: that for any two different identities, a uniformly random evaluation point makes their parity fingerprints agree with probability exactly one half, independently across points.

Editorial extensions

If this is right

If Theorem 1 holds, a watermark of n bits can be recovered from just n+λ surviving token pairs, with the failure probability halving for each extra pair.
Because observations are position-independent, the detector can work on unordered collections of token pairs, making the scheme robust to insertions, deletions, and sentence reordering by construction.
All corruption sources fold into a single crossover probability p of a binary symmetric channel, giving closed-form formulas for the minimum text length needed for a target recovery confidence.
Fragmentation of a long identity into m-bit segments keeps recovery complexity near 2^{m/2} per segment, so identities of hundreds of bits remain feasible while preserving sync-free operation.
The same pairwise congruence embeds naturally into diffusion language models, where the text is refined until all neighboring pairs satisfy the watermark constraints; the basic commit algorithm converges in O(log N / ε) expected iterations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper's Assumption 1—that parity evaluations of two distinct polynomials agree with probability exactly 1/2—is not true for the raw parity map: for identities 0 and x, the fingerprints agree on all even α, so the agreement probability is (q+1)/(2q) rather than 1/2. If this gap is not fixed (e.g., by preprocessing the polynomial or adding a mask), Theorem 1's exponential bound may degrade.
A natural testable extension is to replace plain parity with a balanced Boolean function of the evaluation, or to hash the evaluation point through a random mask, restoring the 1/2 agreement property and making the security analysis rigorous for all pairs of identities.
The BSC model treats every token pair as equally reliable, but natural language has very uneven token frequencies; frequent function words will generate repeated evaluation points and thus fewer independent observations. The paper's Remark 1 acknowledges this; a practical scheme may need context-window hashing to preserve sample size, which slightly re-introduces synchronization sensitivity.
The diffusion-model analysis depends on an independence assumption for left/right constraints that ignores spatial correlation in text; a correlated-error channel model would be a more demanding test of the commit algorithms.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

You should know two things about this paper: the core construction is genuinely new, and the main theorem is not established. The idea is to encode each watermark bit as the parity of a Reed–Solomon polynomial evaluated at a keyed-hash point derived from a single token pair. That makes every observed bit self-contained and lets you recover in any order — a real step beyond block-based schemes like Qu et al. The paper also gives concrete recovery algorithms (exhaustive, meet-in-the-middle, fragmentation) and a clean BSC-style redundancy analysis. If the probabilistic model were right, the redundancy numbers would be attractive.

It isn't right, though. Assumption 1 says that for any two distinct identities, their parity fingerprints agree on exactly half of the evaluation points. That fails for the paper's own map. Take S=0 and T=x over F_q with q odd: φ_0 is always 0, and φ_T is α mod 2, which is 0 on (q+1)/2 of the q field elements. So the agreement probability is (q+1)/(2q), not 1/2. The counterexample is simple and it's not an edge case — it's a pair of valid identities. The independence part of the assumption is also just asserted; evaluations at different points are deterministic functions of the hash, and the paper gives no argument that they behave as independent Bernoulli draws. Theorem 1 is literally a union bound over that halving assumption, so the paper's headline 'small redundancy suffices' is unsupported.

There is a second, quieter problem. Section 6.2 models corruption as a BSC and claims recovery succeeds whenever at least n of the observed bits are correct. But the decoding algorithms in Section 5 require a candidate to match all observed bits. No algorithm is given to find the identity when an unknown subset of the observations is wrong. So even a repaired Assumption 1 wouldn't give the claimed BSC robustness without an additional error-correction step.

The paper is not sloppy in the usual ways: it states its assumptions, admits in Remark 1 that repeated tokens reduce the effective sample size, and provides worked examples. The diffusion sections are mostly heuristic and separate, but they don't prop up the main claim.

Bottom line: the construction is worth thinking about, and the specific flaw might be fixable — e.g., by moving to a genuinely random linear map over F_2. As written, the central guarantee collapses. I'd send it to a serious referee rather than desk-reject, because the idea is novel and the error is specific and diagnosable; a reviewer could point to the exact assumption that needs repair. But I wouldn't cite the current version.

Recommendation: engage, but treat the main theorem as unproven until Assumption 1 is either proven or replaced.

Referee Report

5 major / 5 minor

Summary. The paper proposes a synchronization-free watermarking scheme for LLMs. Each identity is encoded as an n-bit vector and represented by a polynomial f_S over F_q; every consecutive token pair embeds one bit equal to f_S(α) mod 2, with the evaluation point α derived from a keyed hash of the preceding token. Recovery searches for the unique identity consistent with all observed parity bits. The paper claims that under Assumption 1 (balanced, independent binary evaluations), m = n + λ observed bits recover the identity with failure probability < 2^{-λ}, and that corruption can be modeled as a Binary Symmetric Channel so that only small redundancy is needed. It also sketches extensions to diffusion language models with three commit algorithms and compares exhaustive and meet-in-the-middle recovery.

Significance. The high-level idea — one self-contained algebraic congruence per token pair, giving synchronization-free embedding — is interesting and, if the analysis were sound, would be a useful contribution. However, the central probabilistic guarantee is not established: Assumption 1 is demonstrably violated by the paper's own parity map, the BSC recovery analysis is not matched to the decoding algorithms, and the independence assumptions are not justified by the construction. The paper contains no experiments to support the claimed robustness. As it stands, the main quantitative conclusions are unsupported.

major comments (5)

[Section 3, Assumption 1; Section 3.1, Theorem 1] The fingerprint φ_S(α)=f_S(α) mod 2 does not satisfy Assumption 1. For S=0 (zero polynomial) and T=x, φ_0(α)=0 for all α while φ_T(α)=α mod 2; they agree on the (q+1)/2 even elements of F_q, so Pr[agree]=(q+1)/(2q) > 1/2 for odd q (e.g., 3/5 for q=5). Thus the halving property and the union-bound proof of Theorem 1 do not apply to the proposed construction. Since Theorem 1 underpins the "small redundancy" claims in Sections 4 and 6.2, the central quantitative guarantee is unsupported.
[Section 6.2] The recovery analysis assumes success whenever X≥n correct bits are observed, with X~Binomial(N,1−p). However, the decoding algorithms in Section 5 (exhaustive search and meet-in-the-middle) require a candidate that agrees with all observed bits; with p>0, no identity will match every corrupted observation. The paper does not provide a decoder that tolerates an unknown subset of errors, so the binomial formula and Tables 2–4 do not follow from the proposed algorithms.
[Section 3, Assumption 1; Section 4] The independence of evaluations is not established. The evaluation point is α_i=H(K,id(t_i)) mod q; two pairs sharing the same preceding token yield identical points and identical bits. Remark 1 concedes this and suggests a context-window fix, but the main formulas ignore the resulting reduction in effective sample size. Moreover, the second token of pair i is the first token of pair i+1, so the color of one pair influences the hash input of the next, creating dependencies between embedded bits that the BSC model does not capture.
[Section 3, Proposition 1] The parameter regime makes collisions among evaluation points non-negligible. For n=60, q must exceed 120, so q≈127; with m=n+λ around 60–70, the collision bound m(m−1)/(2q) exceeds 1 and the union bound is vacuous. The paper neither imposes m<q nor incorporates repeated evaluation points into the halving analysis, so the redundancy estimates for large n are not justified.
[Section 3.1, Theorem 1] Theorem 1 is logically a direct consequence of Assumption 1 rather than of the algebraic construction. The proof uses Assumption 1 to assert that each observation halves the candidate space, and the paper does not derive this balancing property from the parity of Reed–Solomon evaluations. The claim that the assumption "reflects the behaviour observed experimentally" is unsupported by any experiments. Thus the central reliability guarantee is assumed, not proved.

minor comments (5)

[Sections 3 and 3.1] The fingerprint function is denoted ϕ_S in the definition but φ_S in the proof of Theorem 1; unify the notation.
[Section 9.4, Example 4] "Theorem??" is an unresolved cross-reference; it should refer to Theorem 4.
[Section 6.1] The probabilities Pr[undetected insertion]≈1/4, etc., are computed but never used in the BSC formulas of Section 6.2; either connect them to the channel model or remove them.
[References] Reference [16] is dated 2025 while the manuscript is dated 2026; verify citation details and formatting.
[Section 4, step 3] "Any binary watermarking mechanism" is vague; specify how the logit bias is applied and how the second token's color is decoded during extraction.

Circularity Check

1 steps flagged · score 6.0 of 10

Theorem 1's recovery guarantee is Assumption 1 restated; the assumed halving property is not derived and fails for the proposed parity fingerprint.

self definitional [Section 3, Assumption 1 and Section 3.1, Theorem 1]
"Assumption 1 (Balanced Binary Evaluation) For every pair of distinct identities S, T∈S, and every evaluation point chosen uniformly from Fq, Pr [ϕS(α) =ϕT (α)] = 1/2. Furthermore, evaluations performed at distinct points are assumed to be statistically independent. ... Theorem 1. Suppose that the binary fingerprint evaluations satisfy Assumption 1. Let m=n+λ, λ≥0, be the number of independently observed fingerprint bits. Then the probability that the embedded identity cannot be recovered is bounded by Pr[Failure]<2^−λ."

The proof of Theorem 1 is literally the union bound over Assumption 1: for each T≠S the assumption gives Pr[φ_T(α_i)=φ_S(α_i)]=2^{−m}, so Pr[Failure]≤(2^n−1)2^{−m}=2^{−λ}. Thus the advertised 'small redundancy' guarantee is not derived from the Reed–Solomon parity construction; it is the assumed halving-and-independence property restated. The paper then reads the assumption back as an established property: 'The preceding analysis establishes that the proposed fingerprinting mechanism possesses... one statistically independent binary constraint.' Moreover the assumption is not merely unproved but false for the proposed map: for S=0, T=x, agreement probability is (q+1)/(2q)>1/2, so the theorem's hypothesis does not hold for the construction. Hence the quantitative result is conditional on a

full rationale

The central circular step is Theorem 1. Assumption 1 postulates exactly the probabilistic behavior that Theorem 1 uses: each evaluation halves the candidate set and evaluations are independent. The proof supplies no algebraic property of φ_S; it is a one-line union bound. Yet Section 3.1 states that the mechanism 'possesses' the property of contributing one independent binary constraint, and the abstract and conclusions read the redundancy result back as if established by the construction. Because the assumption is not derived and is actually false for the parity map (S=0 vs. T=x, agreement probability (q+1)/(2q)>1/2), the central quantitative claim is unsupported: conditional on the assumption it is valid, but as a statement about the proposed fingerprints it is a postulate wearing the guise of a result. This is partial circularity rather than full equivalence: the synchronization-free encoding, the recovery algorithms, and the diffusion commit analyses are separate content. There are no relevant load-bearing self-citations; cited work is external. Section 6.2 also contains an independent gap—'successful recovery occurs whenever X≥n' assumes the detector can exploit any n correct observations, but the decoding algorithms search for a candidate matching all observed bits and no decoder for an unknown corrupted subset is given—but that is a correctness/omitted-proof concern, not itself a circularity, so it does not affect the score.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper's quantitative guarantees reduce to Assumption 1 (balanced independent parity evaluations) plus a BSC model with unmeasured parameter p. Both are imposed rather than derived. For the actual parity-of-field-value map, Assumption 1 is demonstrably false in general, so the central reliability bound is not established.

free parameters (2)

BSC crossover probability p
Effective per-bit corruption probability combining embedding failures and editing operations. It is never measured or estimated; all transmission-length tables are parameterized by p.
Diffusion embedding success probability ε
Assumed to lie in [1/2,1] and used for all diffusion commit-algorithm results. No measurement or bound from a real diffusion language model is provided.

assumptions (4)

ad hoc to paper Assumption 1: for every distinct S,T and uniform α, Pr[φ_S(α)=φ_T(α)]=1/2, with independence across distinct α
Central to Theorem 1. Not proved, and false in simple cases: S=0, T=x gives agreement probability (q+1)/(2q) > 1/2.
domain assumption Keyed hash H behaves as a random oracle, giving uniform evaluation points and right-constraint probability 1/2
Standard cryptographic idealization, used in Sections 4 and 9. Acceptable as a modeling assumption but unverified for concrete hash choices.
domain assumption All corruption events are independent, giving a memoryless Binary Symmetric Channel
Used to derive N* formulas. Insertions, deletions, substitutions and paraphrasing are asserted to compose into independent bit flips without empirical validation.
ad hoc to paper Assumption 2: token colors independent; left constraint probability ε, right constraint probability 1/2, and the two are independent
Underlies all diffusion commit-algorithm results. No diffusion-model experiment or theoretical justification is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Synchronization-Free Algebraic Fingerprints for Large Language Models: From Autoregressive to Diffusion Models." pith.science (2026). https://pith.science/paper/BFY262O5

@misc{pith2026260716648,
  author       = {Pith},
  title        = {Pith review of: Synchronization-Free Algebraic Fingerprints for Large Language Models: From Autoregressive to Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BFY262O5}},
  note         = {Machine review of arXiv:2607.16648}
}

read the original abstract

Large Language Models (LLMs) have created an urgent need for reliable watermarking methods that enable attribution of generated text while remaining robust to editing and paraphrasing. We propose a novel synchronization-free watermarking scheme in which every watermark consists of a single binary congruence generated from a pair of neighbouring tokens. For each token pair, a cryptographic hash determines an evaluation point of a Reed--Solomon polynomial representing the secret identity, while the parity of the polynomial evaluation determines the watermark bit embedded into the second token of the pair. Since each congruence is self-contained and depends only on the local token pair, the proposed construction is naturally resistant to insertions, deletions, and token reordering. We analyse the recovery problem from an algebraic perspective, discuss several decoding algorithms suitable for different identity sizes, and model watermark corruption as a Binary Symmetric Channel. The analysis shows that reliable recovery requires only a small redundancy even for relatively high token corruption rates. Unlike existing block-based watermarking schemes, the proposed method avoids synchronization problems while providing a flexible framework for embedding both short and long secret identities.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 7 linked inside Pith

[1]

Rennie, Mikhail Pavlov, Jacob Devlin, Sanjay Aggarwal, Mike Lewis, Neil Houlsby, Colin Raffel, Barbara Plank, Lee Howard, Martin D

Aakanksha Chowdhery, Anish Vaswani, Steven J. Rennie, Mikhail Pavlov, Jacob Devlin, Sanjay Aggarwal, Mike Lewis, Neil Houlsby, Colin Raffel, Barbara Plank, Lee Howard, Martin D. Riley, Michael Swietojanski, Mo Yu, Dipanjan Das, Mike Schuster, Yiming Yang, Jakob Uszkoreit, and Yonghui Wu. PaLM: Scaling language modeling with pathways. InProceedings of the ...

2022
[2]

Cox, Matthew L

Ingemar J. Cox, Matthew L. Miller, Jeffrey A. Bloom, Jessica Fridrich, and Ton Kalker.Digital Watermarking and Steganography. Morgan Kaufmann, 2 edition, 2007

2007
[3]

Robust data watermarking in language models by injecting fictitious knowledge

Xinyue Cui, Johnny Tian-Zheng Wei, Swabha Swayamdipta, and Robin Jia. Robust data watermarking in language models by injecting fictitious knowledge. ArXiv eprint 2503.04036, 03 2025

arXiv 2025
[4]

E. O. Elliott. Estimates of error rates for codes on burst-noise channels.Bell System Technical Journal, 42(5):1977– 1997, 1963

1977
[5]

Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick

Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick. ArXiv eprint 2402.12948, 02 2024. REFERENCES 25

arXiv 2024
[6]

Edgar N. Gilbert. Capacity of a burst-noise channel.Bell System Technical Journal, 39(5):1253–1265, 1960

1960
[7]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors,Proceedings of the 40th International Conference on Machine Learning (ICML 2023), volume 202 ofProceedings of Mac...

2023
[8]

Synthid-text: Practical watermarking for large language models.Nature, 2024

Pushmeet Kohli et al. Synthid-text: Practical watermarking for large language models.Nature, 2024

2024

Show all 22 references

[9]

Robust and semantically invariant watermarks for large language models.ICLR, 2024

Rohith Kuditipudi et al. Robust and semantically invariant watermarks for large language models.ICLR, 2024

2024
[11]

A survey of results for deletion channels and related synchronization channels.Probability Surveys, 6:1–33, 2009

Michael Mitzenmacher. A survey of results for deletion channels and related synchronization channels.Probability Surveys, 6:1–33, 2009

2009
[12]

Ruslan Morozov and Tolga M. Duman. Markov insertion/deletion channels: Information stability and capacity bounds.arXiv preprint arXiv:2401.16063, 2024

2024 arXiv
[13]

Capacity and coding for the gilbert–elliott channels.IEEE Transactions on Information Theory, 35(6):1277–1290, 1989

Mordechai Mushkin and Isaac Bar-David. Capacity and coding for the gilbert–elliott channels.IEEE Transactions on Information Theory, 35(6):1277–1290, 1989

1989
[14]

Ensemble watermarks for large language models

Georg Niess and Roman Kern. Ensemble watermarks for large language models. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL), 2025

2025
[15]

GPT-4 Technical Report.https://openai.com/research/gpt-4, 2023

OpenAI. GPT-4 Technical Report.https://openai.com/research/gpt-4, 2023

2023
[16]

Provably robust multi-bit watermarking for AI-generated text.arXiv preprint arXiv:2401.16820, 2025

Wenjie Qu, Wengrui Zheng, Tianyang Tao, Dong Yin, Yanze Jiang, Zhihua Tian, Wei Zou, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for AI-generated text.arXiv preprint arXiv:2401.16820, 2025. v5, 28 Jan 2025

2025 arXiv
[17]

Rabiner.A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition, volume 77

Lawrence R. Rabiner.A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition, volume 77. 1989

1989
[18]

Watermarking makes language models radioactive

Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. ArXiv eprint, 02 2024

2024
[19]

LLaMA: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971, 2023

Hugo Touvron, Thibault Louvrier, Matthieu Cord, Piotr Bojanowski, Edouard Grave, and Guillaume Lample. LLaMA: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971, 2023

2023 arXiv
[20]

An end-to-end model for logits based large language models watermarking, 2025

Ka Him Wong, Jicheng Zhou, Jiantao Zhou, and Yain-Whar Si. An end-to-end model for logits based large language models watermarking, 2025

2025
[21]

Zhenyu Xu, Kun Zhang, and Victor S. Sheng. Freqmark: Frequency-based watermark for sentence-level detection of llm-generated text. ArXiv eprint 2410.10876, 10 2024

2024 arXiv
[22]

Provable robust watermarking for ai-generated text

Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. InThe Twelfth International Conference on Learning Representations (ICLR), 2024

2024
[23]

Chaoyi Zhu, Jeroen Galjaard, Pin-Yu Chen, and Lydia Y. Chen. Duwak: Dual watermarks in large language models. ArXiv eprint 2403.13000, 03 2024

2024 arXiv

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.

[1] [1]

Rennie, Mikhail Pavlov, Jacob Devlin, Sanjay Aggarwal, Mike Lewis, Neil Houlsby, Colin Raffel, Barbara Plank, Lee Howard, Martin D

Aakanksha Chowdhery, Anish Vaswani, Steven J. Rennie, Mikhail Pavlov, Jacob Devlin, Sanjay Aggarwal, Mike Lewis, Neil Houlsby, Colin Raffel, Barbara Plank, Lee Howard, Martin D. Riley, Michael Swietojanski, Mo Yu, Dipanjan Das, Mike Schuster, Yiming Yang, Jakob Uszkoreit, and Yonghui Wu. PaLM: Scaling language modeling with pathways. InProceedings of the ...

2022

[2] [2]

Cox, Matthew L

Ingemar J. Cox, Matthew L. Miller, Jeffrey A. Bloom, Jessica Fridrich, and Ton Kalker.Digital Watermarking and Steganography. Morgan Kaufmann, 2 edition, 2007

2007

[3] [3]

Robust data watermarking in language models by injecting fictitious knowledge

Xinyue Cui, Johnny Tian-Zheng Wei, Swabha Swayamdipta, and Robin Jia. Robust data watermarking in language models by injecting fictitious knowledge. ArXiv eprint 2503.04036, 03 2025

arXiv 2025

[4] [4]

E. O. Elliott. Estimates of error rates for codes on burst-noise channels.Bell System Technical Journal, 42(5):1977– 1997, 1963

1977

[5] [5]

Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick

Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick. ArXiv eprint 2402.12948, 02 2024. REFERENCES 25

arXiv 2024

[6] [6]

Edgar N. Gilbert. Capacity of a burst-noise channel.Bell System Technical Journal, 39(5):1253–1265, 1960

1960

[7] [7]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors,Proceedings of the 40th International Conference on Machine Learning (ICML 2023), volume 202 ofProceedings of Mac...

2023

[8] [8]

Synthid-text: Practical watermarking for large language models.Nature, 2024

Pushmeet Kohli et al. Synthid-text: Practical watermarking for large language models.Nature, 2024

2024