Pith. sign in

REVIEW 2 major objections 4 minor 42 references

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

T0 review · 2 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A dual-signal watermark can prove both where text came from and whether it was altered.

desk verdict Cocktail is a genuine dual-signal watermarking advance, but its headline tamper-detection number is position-dependent and needs scoping before the paper is fully honest. read the letter →

arxiv 2608.12713 v1 pith:WYQ25ESY submitted 2026-08-13 cs.CR cs.AIcs.CL

Xiaoyan Feng , Yanjun Zhang , He Zhang , Leo Yu Zhang , Shirui Pan This is my paper · ORCID
classification cs.CRcs.AIcs.CL
keywords LLMwatermarkingprovenancetamperevidencepiggybackspoofingrobustandfragilesignalsunbiasedtournamentreweightingnormalizedtextseedingthree-statedetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a single watermark can serve two opposing goals at once: tracing an LLM's output to its source even after rewriting, and flagging when the text has been altered. Existing watermarks prioritize edit-robustness for attribution, which lets an attacker change critical content while the text still scores as watermarked, a failure called piggyback spoofing. The proposed method, Cocktail, co-embeds a robust and a fragile signal into every generated token; the first survives edits, the second collapses when the reader-visible text changes. Detection then reads the two scores together and returns Intact, Tampered, or No-Watermark. Across two large language models and two prompt datasets, the method flags 89.5-100% of tampered texts at a 1% false-alarm rate while keeping attribution and generation quality near the strongest single-signal baselines.

What carries the argument

The load-bearing mechanism is the co-embedding of two complementary signals through rounds of unbiased tournament reweighting. Each round reweights the token distribution by a fresh Bernoulli(0.5) green-red list, leaving the expected distribution unchanged; a periodic pattern assigns rounds alternately to the robust and fragile signals, so the round ratio (1:1, 2:1, 4:1) dials their relative strength. Because each signal is seeded on normalized text rather than token IDs, the fragile signal certifies the content the reader actually receives. The short-window robust signal provides attribution, the long-window fragile signal provides tamper evidence, and the joint two-threshold rule partitions the score plane into three states.

What would settle it

Generate a Cocktail-watermarked text, then flip the sentiment of only the final clause (the last 10-20 tokens), keeping the rest untouched. The fragile signal seeds on the full normalized prefix, so the corruption is confined to the tail; if the fragile z-score stays above the calibrated threshold and the detector outputs Intact, the claimed tamper-evidence guarantee is position-dependent and does not cover whole-text integrity.

Watch

Extended reading notes

Core claim

The central claim is that provenance and tamper evidence are not in conflict if the same text carries two independent signals that are seeded differently. Both signals are green-red vocabulary partitions derived from a keyed pseudorandom function, but the robust signal keys on a short window of the preceding normalized text while the fragile signal keys on a long character window over the full normalized prefix. Any edit that changes the normalized text corrupts the fragile seeds of every subsequent token, driving the fragile z-score down, while the short-window robust seed recovers within a few tokens. In the resulting two-dimensional score space, tampered text occupies a distinct region: high robust score, low fragile score. The paper demonstrates that this separation holds across two large language models and two prompt datasets, with tamper detection far above single-signal baselines and without degrading perplexity.

Load-bearing premise

The tamper-evidence guarantee rests on the fragile signal being seeded from the full normalized prefix, so 'intact' means 'unchanged after normalization'; any edit that leaves the normalized text the same, such as a homoglyph replacement, passes as intact, and edits confined to the final tokens are only partially caught.

Editorial extensions

If this is right

  • If the claim holds, one watermarked text can be simultaneously attributed to a model and checked for integrity, closing the piggyback-spoofing hole in single-signal schemes without adding a second, fragile signature.
  • The 2D score plane replaces the binary watermarked/not-watermarked decision with a three-state decision, so a detector can tell 'untouched model output' from 'edited model output' at a tunable false-alarm rate.
  • Because the fragile signal is seeded on normalized text, re-encoding attacks that preserve meaning but change bytes (homoglyphs, case changes, whitespace) are folded away rather than falsely flagged; the paper shows normalization at both seeding and detection keeps scores unchanged.
  • The round-allocation pattern gives practitioners a single knob to trade attribution robustness against tamper sensitivity while keeping generation quality, since each round preserves the expected distribution.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One testable extension the paper leaves implicit: because the fragile window covers the full prefix, edits confined to the final tokens only corrupt the tail of the seeds; a detector that scores trailing segments separately could catch tail-only edits, and this could be verified directly.
  • The complementary-signal recipe may transfer to other generative modalities (images, audio) where a robust and a fragile signal are co-embedded in every output element; the paper notes this possibility for other modalities.
  • The fragile signal's long seeding window makes it harder to steal by querying the detector, so a forger who learns the robust green list will produce text that classifies as Tampered rather than Intact; this asymmetry between the two signals is a security property worth testing under an explicit stealing attack.
  • A practical deployment would need to define and normalize 'reader-visible content' carefully; any adversarial edit that survives the normalizer is by construction invisible to tamper evidence, so the guarantee is only as strong as the normalizer's coverage.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The manuscript proposes Cocktail, a generative watermark for LLM text that co-embeds a robust signal and a fragile signal into every generated token. The robust signal is seeded on a short token window and supports provenance attribution; the fragile signal is seeded on a long normalized-text suffix and is intended to expose any reader-visible edit. Embedding uses multiple rounds of unbiased tournament reweighting with a periodic robust/fragile round allocation, and detection maps the two z-scores through fixed thresholds into three states: Intact, Tampered, and No-Watermark. Experiments with Llama-3.2-1B and Gemma-3-4B on C4 and LFQA compare against KGW, Unigram, SynthID, and SIR, reporting TPR@1%FPR for attribution and tamper evidence plus perplexity. The authors also include ablations on normalization placement, co-embedding, and fragile-window length, and a measurement of the signature-based baseline Bileve.

Significance. If the results hold, Cocktail is a meaningful advance: it is the first scheme in this comparison to provide both provenance and tamper evidence at a 1% FPR operating point, with a mechanism that is elegant and does not rely on fitted constants. The experimental scope (two models, two datasets, five tasks), the ablations supporting the three claimed design necessities, and the honest reproduction of SynthID's unbiasedness theorems in Appendix A are strengths. However, the headline tamper-evidence recall is currently overclaimed because the fragile signal is position-dependent and the evaluation does not include localized edits; further, the reported operating points are calibrated in-sample. These issues are fixable and do not invalidate the design, but they must be addressed before the quantitative claims can be accepted.

major comments (2)
  1. [Section IV.B, Eq. (2); Section V.A/Table I; Section VI] The tamper-evidence claim is position-dependent in a way that the reported numbers do not reflect. Because s_f(t) is a hash of the normalized prefix ending at t-1 (Eq. (2)), an edit at position i changes the fragile seeds only for tokens t > i; tokens at or before i keep their original green-red assignments. Consequently, a text whose edits are concentrated in the final fraction f of its length retains a fragile z-score that grows with (1-f), so the detector can still label it Intact. The abstract and Table I report unqualified tamper-recalls of 89.5-100% based on attacks (random token substitution, sentiment flip) that distribute edits across the text, and Section VI's acknowledgment that "edits confined to the final tokens corrupt only the tail of the fragile seeds" does not quantify or bound this failure. Since piggyback spoofing is exactly a small, localized word substitution, this is load-bearing: the paper should provide a worst-case bound on z_f as a function of the edit position/fraction, or report a positional ablation (e.g., edits in the last 5%, 10%, 20% of tokens) and restrict the stated guarantee accordingly.
  2. [Section V.B and Appendix B] The reported TPR@1%FPR values are obtained with thresholds calibrated on the same data used for the reported rates: tau_r is the 99th percentile of no-watermark z_r and tau_f the 1st percentile of intact z_f. This in-sample calibration can bias the point estimates upward, and Table I reports no confidence intervals or variability measures. The central quantitative claim (89.5-100% tamper detection while maintaining attribution) needs out-of-sample or cross-validated threshold selection, and the key TPRs should be reported with bootstrap or exact binomial confidence intervals.
minor comments (4)
  1. [Section IV.B and Table III] There is a definitional inconsistency in the seeding window: Eq. (2) defines the fragile seed as H(suffix_{n_f}(N(x_{1:t-1}))), i.e., a character window over the normalized prefix without the current token, while Table III states the fragile window is "full normalized prefix + self token" and the robust window is "1 preceding token + self token". Please clarify whether the current token is included in the hash input, since this affects the statistical independence of the hits and the exact meaning of the z-scores.
  2. [Appendix B and Figure 4] Figure 4's caption says thresholds are "calibrated at a 1% tail", while Appendix B specifies tau_f at the 1st percentile of intact z_f; please state explicitly whether the thresholds are one-sided or two-sided, and report the exact FPR on held-out data.
  3. [Section V.B] The sentence "The TPR@1%FPR of each task is the complement of the attacker's success rate" is only true under a binary decision with a fixed false-alarm budget; consider rephrasing to avoid overstating the relationship.
  4. [Appendix B] The sentiment-flip evaluation is scored over 200 tokens while all other tasks are scored over the first 300 tokens; this difference should be stated in the Table I caption or in the evaluation protocol so that the columns are comparable.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the derivation is self-contained and its headline results are measured against external benchmarks.

full rationale

No circularity found. Cocktail's central mechanism is defined directly by Equations (1)-(6): the fragile signal is seeded on the normalized prefix (Eq. 2), so any edit that changes the normalized text corrupts the fragile seeds of subsequent tokens by construction, and the two-dimensional decision rule (Eq. 6) reads the resulting score separation. The tamper-evidence and attribution numbers are empirical results over held-out attacks (Dipper paraphrase, round-trip translation, sentiment flip, token substitution), not fitted parameters renamed as predictions. The only calibrated quantities are the operating-point thresholds tau_r and tau_f, set at the 1% tail of the negative classes; the reported true positive rates are then measured on tampered and watermarked texts, so the headline recall is not forced by the calibration itself. The unbiasedness guarantee is imported from SynthID's theorems and reproduced in Appendix A, with the key unbiasedness step also verified inline (E[1 + g^(i)[x] - q^(i)] = 1); this is an external, parameter-free result rather than a self-citation chain. The authors' own prior work BiMark is cited only as related context, and reference [38] supplies an attack generator rather than a premise of the derivation. The acknowledged limitation that edits confined to the final tokens corrupt only the tail of the fragile seeds is a robustness caveat about position-dependent tamper evidence, not a circular step, and it does not reduce the central claim to its inputs.

Assumptions & free parameters 5 free parameters · 7 assumptions · 0 invented entities

The method introduces no new physical or cryptographic entities; it reconfigures existing watermarking components (green-red lists, tournament reweighting, normalized-text seeding) with two keys and two window lengths. The free parameters are design choices and calibration thresholds, not fitted constants used to manufacture a prediction. The main imported axioms are the SynthID unbiasedness and entropy-budget theorems and the determinism of the normalizer.

free parameters (5)
  • Number of tournament rounds d = 30
    Chosen by hand; controls how much signal is embedded and affects both scores.
  • Robust window h_r = 1 preceding token (self token per Table III)
    Chosen to be short; robustness of provenance under insertions and deletions depends on this choice.
  • Fragile window n_f = full normalized prefix
    Chosen to be maximal; the tamper-evidence separation depends on this.
  • Round ratio d_r:d_f = 1:1, 2:1, 4:1
    Tunable strength dial; the trade-off between attribution and tamper evidence is controlled by this ratio.
  • Detection thresholds tau_r and tau_f = calibrated at 1% FPR per setting
    Standard false-positive control, but they are set from the evaluation data rather than derived.
assumptions (7)
  • domain assumption Two-sample tournament reweighting is non-distortionary (SynthID Theorem 18)
    Cocktail's Eq. (3) is claimed to be the closed form of SynthID's two-sample tournament; the unbiasedness guarantee is imported from SynthID's supplement, not re-proved here.
  • standard math Independent Bernoulli(0.5) green lists across rounds preserve the expected generation distribution
    Used to justify that co-embedding costs no quality; expectation over keys equals the original distribution.
  • domain assumption Hash functions are pseudorandom and keys are secret
    The green-red lists are treated as independent Bernoulli variables; also underlies the null z-score model.
  • domain assumption Normalizer N is idempotent and deterministic across environments
    Generation and detection must reproduce identical normalized seeds; any environment-dependent normalization breaks both signals.
  • domain assumption Collision entropy is consumed monotonically by successive tournament rounds
    Imported from SynthID Appendix H.4; grounds the round-allocation ratio as a monotone strength knob.
  • standard math Under the null, green-list hits are independent Bernoulli(0.5)
    Basis for the z-score null distribution in Eq. (5).
  • ad hoc to paper Round ratio approximately equals signal strength ratio via entropy budget
    The paper states the proxy is not exact because consumption per round is nonlinear and strength does not grow linearly with budget (Section IV.C.b).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks." pith.science (2026). https://pith.science/paper/WYQ25ESY

@misc{pith2026260812713,
  author       = {Pith},
  title        = {Pith review of: Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WYQ25ESY}},
  note         = {Machine review of arXiv:2608.12713}
}
read the original abstract

Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits.

Figures

Figures reproduced from arXiv: 2608.12713 by the authors.

Figure 1
Figure 1. Cocktail co-embeds two signals into one text: a [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. An illustrative example of removal and spoofing attacks on a green–red list watermark [4], with green-token z-score [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Cocktail Overview. (1) Complementary Signals. Both signals are seeded on the normalized preceding text, with a short robust window of hr tokens and a long fragile window of nf characters. (2) Unbiased Signal Co-Embedding. Each step applies rounds of unbiased reweighting, allocated between the two signals, preserving the expected output distribution. (3) 2D Score Space. The two scores zr and zf place the three states… view at source ↗
Figures from the paper (5 more)
Figure 3
Figure 3. Figure 3: Repeated adjustment is where quality is at stake: [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]
Figure 4
Figure 4. Figure 4: Cocktail’s score plane (zr, zf ) on real generations (Llama-3.2-1B, C4). The thresholds τr, τf are each calibrated at a 1% tail, and the three states read off directly. B. Evaluation Protocol The two questions of the problem setup induce two dis￾crimination tasks: (1) …
Figure 5
Figure 5. Figure 5: Score planes under four fragile windows. Intact and tampered text [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Table IV’s examples. Red marks the folded codepoint, and dashed [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: One Gemma-3-4B generation under a sentiment-flip and a homoglyph attack. Orange boxes mark word substitutions. Blue boxes mark homoglyph [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 31 canonical work pages

  1. [1]

    Artificial intelligence act,

    European Union, “Artificial intelligence act,” Regulation (EU) 2024/1689, 2024

    work page 2024

  2. [2]

    California AI transparency act,

    California State Legislature, “California AI transparency act,” Senate Bill No. 942, Chapter 291, Statutes of 2024, 2024

    work page 2024

  3. [3]

    Fact sheet: Biden-harris administration secures voluntary commitments from leading artificial intelligence companies to manage the risks posed by AI,

    The White House, “Fact sheet: Biden-harris administration secures voluntary commitments from leading artificial intelligence companies to manage the risks posed by AI,” https://bidenwhitehouse.archives.gov/, 2023, accessed: 2026-07-29

    work page 2023

  4. [4]

    A watermark for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” inInternational conference on machine learning. PMLR, 2023, pp. 17 061–17 084

    work page 2023

  5. [5]

    Scalable watermarking for identifying large language model outputs,

    S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, J. Welbl, V . Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicovaet al., “Scalable watermarking for identifying large language model outputs,”Nature, vol. 634, no. 8035, pp. 818–823, 2024

    2024

  6. [6]

    Provable robust watermarking for AI-generated text,

    X. Zhao, P. V . Ananth, L. Li, and Y .-X. Wang, “Provable robust watermarking for AI-generated text,” inThe Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=SsmT8aO45L

    work page 2024

  7. [7]

    A semantic invariant ro- bust watermark for large language models,

    A. Liu, L. Pan, X. Hu, S. Meng, and L. Wen, “A semantic invariant ro- bust watermark for large language models,” inInternational Conference on Learning Representations, vol. 2024, 2024, pp. 6499–6519

    work page 2024

  8. [8]

    No free lunch in LLM watermarking: Trade-offs in watermarking design choices,

    Q. Pang, S. Hu, W. Zheng, and V . Smith, “No free lunch in LLM watermarking: Trade-offs in watermarking design choices,” inThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. [Online]. Available: https://openreview.net/forum?id= rIOl7KbSkv

    work page 2024

Show all 42 references
  1. [9]

    Bileve: Securing text provenance in large language models against spoofing with bi-level signature,

    T. Zhou, X. Zhao, X. Xu, and S. Ren, “Bileve: Securing text provenance in large language models against spoofing with bi-level signature,” inThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. [Online]. Available: https://openreview.net/forum?id...

    2024

  2. [10]

    Watermarking of large language models,

    S. Aaronson, “Watermarking of large language models,” Talk at the Simons Institute Workshop on Large Language Models and Transformers, https://simons.berkeley.edu/talks/scott-aaronson-ut- austin-openai-2023-08-17, 2023, accessed: 2026-07-29

    2023

  3. [11]

    Para- phrasing evades detectors of ai-generated text, but retrieval is an effective defense,

    K. Krishna, Y . Song, M. Karpinska, J. Wieting, and M. Iyyer, “Para- phrasing evades detectors of ai-generated text, but retrieval is an effective defense,”Advances in neural information processing systems, vol. 36, pp. 27 469–27 500, 2023

    2023

  4. [12]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,”J. Mach. Learn. Res., vol. 21, no. 1, Jan. 2020

    2020

  5. [13]

    Detectgpt: zero-shot machine-generated text detection using probability curvature,

    E. Mitchell, Y . Lee, A. Khazatsky, C. D. Manning, and C. Finn, “Detectgpt: zero-shot machine-generated text detection using probability curvature,” inProceedings of the 40th International Conference on Machine Learning, ser. ICML’23. JMLR.org, 2023

    2023

  6. [14]

    Robust distortion-free watermarks for language models,

    R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang, “Robust distortion-free watermarks for language models,”Transactions on Machine Learning Research, 2024. [Online]. Available: https:// openreview.net/forum?id=FpaCL1MO2C

    2024

  7. [15]

    SemStamp: A semantic watermark with paraphrastic robustness for text generation,

    A. Hou, J. Zhang, T. He, Y . Wang, Y .-S. Chuang, H. Wang, L. Shen, B. Van Durme, D. Khashabi, and Y . Tsvetkov, “SemStamp: A semantic watermark with paraphrastic robustness for text generation,” inProceedings of the 2024 Conference of the North American Chapter of the Associa...

    2024

  8. [16]

    A robust semantics-based watermark for large language model against paraphrasing,

    J. Ren, H. Xu, Y . Liu, Y . Cui, S. Wang, D. Yin, and J. Tang, “A robust semantics-based watermark for large language model against paraphrasing,” inFindings of the Association for Computational Linguistics: NAACL 2024. Mexico City, Mexico: Association for Computational Lingui...

    2024

  9. [17]

    Adaptive text watermark for large language mod- els,

    Y . Liu and Y . Bu, “Adaptive text watermark for large language mod- els,” inProceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024

    2024

  10. [18]

    Watermarks in the sand: impossibility of strong watermarking for language models,

    H. Zhang, B. L. Edelman, D. Francati, D. Venturi, G. Ateniese, and B. Barak, “Watermarks in the sand: impossibility of strong watermarking for language models,” inProceedings of the 41st International Confer- ence on Machine Learning, ser. ICML’24. JMLR.org, 2024

    2024

  11. [19]

    On the reliability of watermarks for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, M. Shu, K. Saifullah, K. Kong, K. Fernando, A. Saha, M. Goldblum, and T. Goldstein, “On the reliability of watermarks for large language models,” inThe Twelfth International Conference on Learning Representations, 2024. [Online]. Available...

    2024

  12. [20]

    Undetectable watermarks for language models,

    M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” inProceedings of Thirty Seventh Conference on Learning Theory, ser. Proceedings of Machine Learning Research, vol

  13. [21]

    Unbiased watermark for large language models,

    Z. Hu, L. Chen, X. Wu, Y . Wu, H. Zhang, and H. Huang, “Unbiased watermark for large language models,” inThe Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=uWVC5FVidc

    2024

  14. [22]

    A resilient and acces- sible distribution-preserving watermark for large language models,

    Y . Wu, Z. Hu, J. Guo, H. Zhang, and H. Huang, “A resilient and acces- sible distribution-preserving watermark for large language models,” in Proceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024

    2024

  15. [23]

    Improved unbiased watermark for large language models,

    R. Chen, Y . Wu, J. Guo, and H. Huang, “Improved unbiased watermark for large language models,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Jul. 2025, pp. 20 587–2...

    2025

  16. [24]

    Bimark: Unbiased multilayer watermarking for large language models,

    X. Feng, H. Zhang, Y . Zhang, L. Y . Zhang, and S. Pan, “Bimark: Unbiased multilayer watermarking for large language models,”arXiv preprint arXiv:2506.21602, 2025

    2025 arXiv

  17. [25]

    An ensemble framework for unbiased language model watermarking,

    Y . Wu, R. Chen, G. Milis, and H. Huang, “An ensemble framework for unbiased language model watermarking,” inThe Fourteenth International Conference on Learning Representations, 2026. [Online]. Available: https://openreview.net/forum?id=iZ7i2y1YxO

    2026

  18. [26]

    Defending LLM watermarking against spoofing attacks with contrastive representation learning,

    L. An, Y . Liu, Y . Liu, Y . Zhang, Y . Bu, and S. Chang, “Defending LLM watermarking against spoofing attacks with contrastive representation learning,” inSecond Conference on Language Modeling, 2025. [Online]. Available: https://openreview.net/forum?id=n5hmtkdl7k

    2025

  19. [27]

    Cocktail water- marking for digital image protection,

    C.-S. Lu, S.-K. Huang, C.-J. Sze, and H.-Y . M. Liao, “Cocktail water- marking for digital image protection,”IEEE Transactions on Multimedia, vol. 2, no. 4, pp. 209–224, 2000

    2000

  20. [28]

    Watermarking security: theory and practice,

    F. Cayre, C. Fontaine, and T. Furon, “Watermarking security: theory and practice,”IEEE Transactions on Signal Processing, vol. 53, no. 10, pp. 3976–3987, 2005

    2005

  21. [29]

    T. M. Cover and J. A. Thomas,Elements of Information Theory, 2nd ed. Wiley-Interscience, 2006

    2006

  22. [30]

    The llama 3 herd of models,

    A. Grattafiori, A. Dubeyet al., “The llama 3 herd of models,” 2024. [Online]. Available: https://arxiv.org/abs/2407.21783

    2024 arXiv

  23. [31]

    Gemma: Open models based on gemini research and technology,

    G. Team, T. Mesnardet al., “Gemma: Open models based on gemini research and technology,” 2024. [Online]. Available: https://arxiv.org/abs/2403.08295

    2024 arXiv

  24. [32]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,”Journal of machine learning research, vol. 21, no. 140, pp. 1–67, 2020

    2020

  25. [33]

    ELI5: Long form question answering,

    A. Fan, Y . Jernite, E. Perez, D. Grangier, J. Weston, and M. Auli, “ELI5: Long form question answering,” inProceedings of the 57th Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics, Jul. 2019, pp. 3558–3567. [Online]. A...

    2019

  26. [34]

    OPUS-MT – building open translation services for the world,

    J. Tiedemann and S. Thottingal, “OPUS-MT – building open translation services for the world,” inProceedings of the 22nd Annual Conference of the European Association for Machine Translation. Lisboa, Portugal: European Association for Machine Translation, Nov. 2020, pp. 479–480...

    2020

  27. [35]

    gpt-oss-120b & gpt-oss-20b model card,

    OpenAI, “gpt-oss-120b & gpt-oss-20b model card,” 2025. [Online]. Available: https://arxiv.org/abs/2508.10925

    2025 arXiv

  28. [36]

    TweetNLP: Cutting-edge natural language processing for social media,

    J. Camacho-Collados, K. Rezaee, T. Riahi, A. Ushio, D. Loureiro, D. Antypas, J. Boisson, L. Espinosa-Anke, F. Liu, E. Mart ´ınez-C´amara, G. Medina, T. Buhrmann, L. Neves, and F. Barbieri, “TweetNLP: Cutting-edge natural language processing for social media,” in Proceedings of...

    2022

  29. [37]

    Mistral 7b,

    A. Q. Jiang, A. Sablayrolleset al., “Mistral 7b,” 2023. [Online]. Available: https://arxiv.org/abs/2310.06825

    2023 arXiv

  30. [38]

    Character-level perturbations disrupt llm watermarks,

    Z. Zhang, X. Zhang, Y . Zhang, H. Zhang, S. Pan, B. Liu, A. Q. Gill, and L. Zhang, “Character-level perturbations disrupt llm watermarks,” inProceedings 2026 Network and Distributed System Security Symposium. Internet Society, 2026. [Online]. Available: http://dx.doi.org/10.14...

    2026

  31. [39]

    Watermark stealing in large language models,

    N. Jovanovi ´c, R. Staab, and M. Vechev, “Watermark stealing in large language models,” inProceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024

    2024

  32. [40]

    An unforgeable publicly verifiable watermark for large language models,

    A. Liu, L. Pan, X. Hu, S. Li, L. Wen, I. King, and P. S. Yu, “An unforgeable publicly verifiable watermark for large language models,” inThe Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/ forum?id=gMLQwKDY3N

    2024

  33. [41]

    Enhancing LLM watermark resilience against both scrubbing and spoofing attacks,

    H. Shen, B. Huang, and X. Wan, “Enhancing LLM watermark resilience against both scrubbing and spoofing attacks,” inThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [Online]. Available: https://openreview.net/forum?id=RbdLnwEEjk

    2025

  34. [247]

    1125–1139

    PMLR, 30 Jun–03 Jul 2024, pp. 1125–1139. [Online]. Available: https://proceedings.mlr.press/v247/christ24a.html

    2024

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.