REVIEW 5 major objections 5 minor 43 references
BiMarker: Enhancing Text Watermark Detection for Large Language Models with Bipolar Watermarks
T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read Splitting watermarked text into two oppositely-biased poles and comparing green-token counts between them gives a higher z-score lower bound than KGW at no extra false positives, the paper claims.
desk verdict BiMarker's differential-counting idea and its gamma=0.5 experiments are genuinely worth a look, but the paper's central theorem is unproven as written because the proof and Algorithm 1 use different green-list conventions. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The carrying object is the differential z-statistic over a bipolar partition of the text, along with the polarity-embedding rule in Algorithm 1. At each position the embedding assigns a polarity pseudo-randomly with probability $\rho$ of being positive; in positive positions the green list (a random $\gamma|V|$ subset of the vocabulary) has its logits raised by $\delta$, and in negative positions the complementary red list is raised by $\delta$, so the same $\gamma$ share of the vocabulary is perturbed throughout and the token-level distribution change matches KGW. During detection, green tokens are counted within each pole and the statistic subtracts the null expectation $\gamma T_p - (1-\gamma) T_n$; at the ratio $T_p/T_n = (1-\gamma)/\gamma$ the statistic reduces to $(|s|^p_G - |s|^n_G)/\sqrt{T\gamma(1-\gamma)}$. What does the work is the cancellation of the human-text baseline within the same piece of text, replacing KGW's fixed external reference $\gamma T$, plus two supporting results: Theorem 3.1, which lower-bounds the watermarked z-score via the $\alpha = \exp(\delta)$ boosting bound of Lemma A.1, and Theorem 3.2, which bounds the differential false-positive rate by the unipolar rate using Gaussian tail comparison. The same differential statistic is then applied, unchanged in structure, to the entropy-gated token set of SWEET and to the entropy-weighted terms of EWD.
What would settle it
Set $\gamma=0.25$ (or any value away from 0.5) with $T_p/T_n = (1-\gamma)/\gamma$ and check two things. First, simulate the null by applying Algorithm 1's list partitions to thousands of genuinely non-watermarked sequences and estimate the empirical false-positive rate of the Eq. (1) statistic at a KGW-matched threshold; if the statistic is visibly off-center or the FPR exceeds KGW's, Theorem 3.2 fails under the algorithm's own convention. Second, recompute the Theorem 3.1 bound difference, Eqs. (16)-(17), substituting the algorithm's actual negative-pole green list of size $(1-\gamma)|V|$ where the proof uses a list of size $\gamma|V|$, and check whether $B(|z|_d) - B(|z|_k) \geq 0$ still holds over the full range of spike-entropy values; if it turns negative for some values, the claimed strictly higher lower bound is not established.
Extended reading notes
Core claim
BiMarker is a watermarking scheme in which the generating rule itself supplies the baseline. The text is divided into positive and negative poles; the positive pole upweights a random $\gamma|V|$ green list by $\delta$, and the negative pole upweights the complementary red list by the same $\delta$. The detector counts green tokens separately in each pole and forms the differential statistic $z = (|s|^p_G - |s|^n_G - \gamma T_p + (1-\gamma) T_n)/\sqrt{T\gamma(1-\gamma)}$, which, when the pole sizes satisfy $T_p/T_n = (1-\gamma)/\gamma$, collapses to the bare difference of the two green counts divided by $\sqrt{T\gamma(1-\gamma)}$; the null expectation is then zero for any human text regardless of its overall green tendency, and it is this cancellation that the paper identifies as the source of KGW's vulnerability to misestimating non-watermarked text. The paper's central claim is that the differential detector attains a higher theoretical lower bound on the z-score of watermarked text than KGW's single-pole statistic (Theorem 3.1, proved from the green-list probability bound of Lemma A.1), that it does not increase the false-positive rate over non-watermarked text (Theorem 3.2, by Gaussian tail comparison), and that both theorems survive when the differential scheme is layered onto the entropy-gated detector SWEET and the entropy-weighted detector EWD. Because embedding still boosts exactly a $\gamma$ share of the vocabulary by the same $\delta$, the induced change in the generated distribution matches KGW's, so the method is argued to preserve text quality while sharpening detectability.
Load-bearing premise
The load-bearing premise is the detector's null model for human text, namely that the two poles' green-token counts are independent and centered at the differential expectation $\gamma T_p - (1-\gamma)T_n$, together with one consistent definition of the negative pole's 'green list' across the algorithm, the statistic, and the proof; the paper's algorithm and its proof use different definitions of that list whenever $\gamma \neq 0.5$, so the false-positive guarantee is clean only where the two conventions coincide.
Editorial extensions
If this is right
- At a matched false-positive budget, watermarked text is detected more often: at 1% FPR with $\gamma=0.5$ and multinomial sampling, TPR rises from 0.436 to 0.498 at $\delta=0.5$ and from 0.978 to 0.986 at $\delta=1.5$.
- The largest gains sit exactly where KGW is weakest, namely low watermark strength and strict (1% or zero) false-positive targets, so a practitioner can use a smaller $\delta$ (less quality cost) for the same reliability.
- Detection needs no prompt and no auxiliary language model: the within-text pole difference replaces the external $\gamma T$ baseline, so the method applies when the prompt is unavailable and at the same computational cost as KGW.
- Because embedding perturbs the same $\gamma$ share of the vocabulary with the same $\delta$, the text-quality impact equals KGW's, so the detection gain is argued to come without a generation-quality penalty.
- The differential statistic composes with entropy-based optimizations: on code tasks, EWD with BiMarker reaches a best F1 of 0.96 on HumanEval versus 0.869 for EWD alone, with the paper's theorems stated to carry over to SWEET and EWD.
Reading between the lines
- Editorial extension: the cancellation trick should transfer to any watermark that biases a fixed vocabulary split, such as multi-color, semantic, or multi-bit green lists, because what BiMarker replaces is only the external null mean, not the KGW mechanism itself; this is testable by swapping the embedding while keeping the differential detector.
- Editorial caveat: the proof of Theorem 3.1 bounds the negative pole's green count as if its green list had size $\gamma|V|$, whereas Algorithm 1 defines the negative-pole green list as the complementary set of size $(1-\gamma)|V|$; the two conventions coincide only at $\gamma=0.5$, so a re-derivation of the bounds in the algorithm's own convention is the natural next step before relying on the exa
- Editorial extension: the paper's motivation study reports a Pearson correlation of 0.7 between human and watermarked green-token counts; a stress test across other domains (multilingual text, dialogue, code) would show whether the differential gain shrinks when that correlation is weak.
- Editorial extension: the hard-coded position-based polarity used with SWEET and EWD anchors the signal to absolute token positions, so insertions, deletions, or reordering that desynchronize the polarity clock could degrade the differential signal more than they degrade KGW's single-pole signal; the paper's limitations section concedes related fragility from adjacent-token dependencies in code.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes BiMarker, a KGW-style watermarking method that alternates between two poles: in the positive pole the usual gamma-fraction green list is boosted, while in the negative pole the complementary list (size 1-gamma) is treated as green and the other list is boosted. Detection uses a differential z-score that compares green-token counts in the two poles. The paper claims that this differential statistic has a higher theoretical lower bound than KGW's z-score without increasing the false positive rate (Theorems 3.1 and 3.2), and it reports experiments on news-like text and code generation showing improved TPR at fixed FPR, especially at gamma=0.5, as well as compatibility with SWEET and EWD and preserved text quality (PPL, pass@1).
Significance. If the theoretical claims were correct, BiMarker would be a practically attractive, zero-overhead enhancement to KGW. The paper should be credited for clean empirical comparisons at gamma=0.5, quality checks (PPL and pass@1), robustness evaluation via back-translation, and for demonstrating that the bipolar construction can be combined with SWEET and EWD. However, the theoretical core is not established: the proof of Theorem 3.1 is inconsistent with Algorithm 1, the final algebra in the proof is incorrect for gamma != 0.5, the entropy-maximization step uses the wrong direction of convexity, and the proof of Theorem 3.2 contains formal errors. Since the theoretical analysis is presented as a main contribution and is used to explain the experimental gains, these issues are load-bearing.
major comments (5)
- [Appendix C.1, Eq. (14)] The proof of Theorem 3.1 uses a negative-pole green-count bound that does not correspond to Algorithm 1. In Algorithm 1, when the polarity is negative, the green list is list2 of size (1-gamma)|V| and the logits of list1 (size gamma|V|) are boosted. Equation (14) instead bounds the expected negative-pole green count by gamma*Tn/(1+(alpha-1)*gamma), which is the value obtained when a green list of size gamma|V| is boosted. Under the Algorithm 1 convention, the negative-pole green probability in the uniform case is (1-gamma)*Tn/(1+(alpha-1)*gamma), which is larger than the proof's bound whenever gamma<0.5, and for non-uniform token distributions the discrepancy can be much larger. Therefore the lower bound in Eq. (15) is not a valid bound for the method defined in Algorithm 1.
- [Appendix C.1, Eqs. (16)-(17)] Even under the proof's own convention, the final step '>= ... = 0' in Eq. (17) is algebraically valid only when gamma=0.5. The expression equals Tn*[1 - gamma*(alpha+1)/(1+(alpha-1)*gamma)] / sqrt(T*gamma*(1-gamma)), which is negative for gamma>0.5. Since Algorithm 1 and Theorem 3.1 allow any gamma in (0,1), the claim that BiMarker's lower bound 'consistently exceeds' KGW's lower bound is false as stated; at a minimum a condition such as gamma <= 0.5 would need to be stated and justified.
- [Appendix C.1, paragraph before Eq. (14)] The proof treats the uniform token distribution as the case that maximizes the negative-pole green count and uses it as an upper bound. This is backwards: for a fixed green-list size g, the green probability under red-list boosting is P_G/[1+(alpha-1)*(1-P_G)], which is convex in P_G for alpha>1. Jensen's inequality then implies that the uniform case gives a lower bound on the expected green probability, not an upper bound. Consequently, subtracting gamma*Tn/(1+(alpha-1)*gamma) in Eq. (14) is not conservative, and the argument cannot establish a lower bound on the differential z-score.
- [Appendix C.2, Eqs. (20)-(22)] The proof of Theorem 3.2 is not rigorous as written. Equation (21) is missing the density f(x) in the integrand and uses mu_Tn in the numerator where mu_Tp is required. Equation (22) then upper-bounds the integrand by the constant 1-Phi(t/sigma_T) and appears to integrate it over (-infinity, infinity), which diverges; the claim that 'x - gamma*Tn > 0' is not true on the entire integration range. The asserted relationship F_KGW >= F_Diff is therefore not established by the given argument.
- [Section 3.3, Table 1, Figure 3] Under the iid model assumed in Theorem 3.1 with gamma=0.5 and Tp=Tn, the BiMarker differential statistic is exactly equivalent to the KGW statistic: the negative-pole green count can be written as T/2 minus a Binomial(T/2,p_p) variable, so G_p - G_n has the same distribution as KGW's G - T/2. Thus no strict improvement in the z-score distribution can arise in this model. The empirical gains in Table 1 and Figure 3 must therefore come from a mechanism not captured by Theorem 3.1 (for example, hard-coded polarity, null-mean misspecification, or non-iid text structure), and the paper should state and analyze that mechanism explicitly.
minor comments (5)
- [Section 3.1 and 3.2] The heading 'Movitation' should be 'Motivation', and the sentence 'Notably, our method consistently increases logits across gamma proportion of the vocabulary' is duplicated in Section 3.2; one copy should be removed.
- [Section 4] The main high-entropy experiments do not specify whether polarity assignment uses the pseudo-random rule of Algorithm 1 or the position-based hard-coded rule described later. This matters because random polarity makes Tp and Tn random, which changes the null variance of the statistic in Eq. (1).
- [Table 2] The column header 'B EST' is unclear and is presumably intended to be 'BEST'; please clarify.
- [Appendix C.2] The symbol t is defined in Eq. (20) as z_threshold * sqrt(T*gamma*(1-gamma)) and then redefined in the EWD discussion; using distinct symbols would avoid confusion.
- [References] Langley (2000) appears in the bibliography but is not cited in the text, and Holtzman et al. (2019) is cited only in Appendix D.1; please clean up the citation list.
Circularity Check
No significant circularity: BiMarker's differential statistic is anchored to the external KGW baseline and derived from stated green-list definitions, with no fitted parameter renamed as a prediction.
full rationale
Walking the derivation chain, I find no circular step that reduces a prediction to an input. BiMarker's differential z-statistic (Eq. 1) is defined directly from the null expected difference Tp·γ − Tn·(1−γ), which follows from the green/red list sizes in Algorithm 1; it is not fitted to the data that the paper later predicts. The central theoretical claim, Theorem 3.1, is an algebraic comparison of lower bounds obtained from KGW's Lemma A.1, an external baseline result, and the proof does not rely on a self-citation chain. The optimal polarity ratio ρ = (1−γ)/γ is derived from the stated variance-minimizing condition Tp/Tn = (1−γ)/γ, then validated experimentally across ρ values rather than fit as a free parameter. The paper's experimental comparisons against KGW, SWEET, and EWD are external benchmarks, and the method requires no fitted constants to operate. There is an apparent rigor concern in Appendix C.1: the proof uses an unproved equality S* = S*_p and appears to treat the negative pole's green list as having size γ|V|, while Algorithm 1 assigns negative-pole green tokens to the (1−γ)|V| list; however, this is an internal correctness/proof-consistency issue, not a circular reduction of the theorem to its assumptions. The limitations section candidly acknowledges hard-coded polarity risks and token-dependence assumptions, which further supports that the paper is not concealing a circular derivation. Accordingly, the appropriate circularity finding is none, with score 0.
Assumptions & free parameters
free parameters (5)
- gamma (green-list fraction) =
0.25, 0.5 in main experiments
- delta (watermark strength) =
0.25 to 2.5 in main experiments
- rho (positive polarity probability) =
0.5 (gamma=0.5), 0.75 (gamma=0.25), swept 0.1-0.9 in Figure 6
- polarity cycle length for code tasks =
20 positive/20 negative tokens for KGW and EWD; 15/15 for SWEET
- entropy threshold tau (SWEET) =
0.695
assumptions (5)
- domain assumption Green-token counts in non-watermarked text follow a Gaussian distribution under the null hypothesis.
- domain assumption Positive and negative pole token counts are independent and Gaussian with variances sigma_Tp^2 and sigma_Tn^2.
- ad hoc to paper Average spike entropy of the whole sequence equals that of the positive pole (S*=S*p).
- standard math Spike entropy is at most 1.
- domain assumption Human-written and watermarked green-token counts follow a similar trend across contexts.
Cite this review
Pith. "Pith review of BiMarker: Enhancing Text Watermark Detection for Large Language Models with Bipolar Watermarks." pith.science (2026). https://pith.science/paper/4K5K2PAZ
@misc{pith2026250112174,
author = {Pith},
title = {Pith review of: BiMarker: Enhancing Text Watermark Detection for Large Language Models with Bipolar Watermarks},
year = {2026},
howpublished = {\url{https://pith.science/paper/4K5K2PAZ}},
note = {Machine review of arXiv:2501.12174}
}
read the original abstract
The rapid growth of Large Language Models (LLMs) raises concerns about distinguishing AI-generated text from human content. Existing watermarking techniques, like \kgw, struggle with low watermark strength and stringent false-positive requirements. Our analysis reveals that current methods rely on coarse estimates of non-watermarked text, limiting watermark detectability. To address this, we propose Bipolar Watermark (\tool), which splits generated text into positive and negative poles, enhancing detection without requiring additional computational resources or knowledge of the prompt. Theoretical analysis and experimental results demonstrate \tool's effectiveness and compatibility with existing optimization techniques, providing a new optimization dimension for watermarking in LLM-generated content.
Figures
Figures from the paper (4 more)
Reference graph
Works this paper leans on
-
[1]
Program synthesis with large language models
Austin, J., Odena, A., Nye, M., Bosma, M., Michalewski, H., Dohan, D., Jiang, E., Cai, C., Terry, M., Le, Q., et al. Program synthesis with large language models. arXiv preprint arXiv:2108.07732, 2021
arXiv 2021
-
[2]
M., Gebru, T., McMillan-Major, A., and Shmitchell, S
Bender, E. M., Gebru, T., McMillan-Major, A., and Shmitchell, S. On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, New York, NY, USA, 2021. Association for Computing Machinery
work page 2021
-
[3]
S., Abercrombie, G., Spruit, S., Hovy, D., Dinan, E., Boureau, Y.-L., and Rieser, V
Bergman, A. S., Abercrombie, G., Spruit, S., Hovy, D., Dinan, E., Boureau, Y.-L., and Rieser, V. Guiding the release of safer E 2 E conversational AI through value sensitive design. In Proceedings of the 23rd Annual Meeting of the Special Interest Group on Discourse and Dialogue, September 2022
work page 2022
-
[4]
Bad characters: Imperceptible nlp attacks
Boucher, N., Shumailov, I., Anderson, R., and Papernot, N. Bad characters: Imperceptible nlp attacks. In 2022 IEEE Symposium on Security and Privacy (SP), pp.\ 1987--2004. IEEE, 2022
work page 2022
-
[5]
Brassil, J. T., Low, S., Maxemchuk, N. F., and O'Gorman, L. Electronic marking and identification techniques to discourage document copying. IEEE Journal on Selected Areas in Communications, 13 0 (8): 0 1495--1504, 1995
work page 1995
-
[6]
T., Li, Y., Lundberg, S., et al
Bubeck, S., Chandrasekaran, V., Eldan, R., Gehrke, J., Horvitz, E., Kamar, E., Lee, P., Lee, Y. T., Li, Y., Lundberg, S., et al. Sparks of artificial general intelligence: Early experiments with gpt-4. arXiv preprint arXiv:2303.12712, 2023
arXiv 2023
-
[7]
Chen, M., Tworek, J., Jun, H., Yuan, Q., Pinto, H. P. D. O., Kaplan, J., Edwards, H., Burda, Y., Joseph, N., Brockman, G., et al. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374, 2021
arXiv 2021
-
[9]
Undetectable watermarks for language models
Christ, M., Gunn, S., and Zamir, O. Undetectable watermarks for language models. arXiv preprint arXiv:2306.09194, 2023 b
arXiv 2023
Show all 43 references
-
[10]
Machine generated text: A comprehensive survey of threat models and detection methods
Crothers, E., Japkowicz, N., and Viktor, H. Machine generated text: A comprehensive survey of threat models and detection methods. In Proceedings of arXiv, arXiv, 2022. arXiv. doi:10.48550/arXiv.2210.07321. URL http://arxiv.org/abs/2210.07321
-
[11]
WordNet: An electronic lexical database
Fellbaum, C. WordNet: An electronic lexical database. MIT Press, 1998
1998
-
[12]
Three bricks to consolidate watermarks for large language models
Fernandez, P., Chain, A., Tit, K., Chappelier, V., and Furon, T. Three bricks to consolidate watermarks for large language models. In 2023 IEEE International Workshop on Information Forensics and Security (WIFS), pp.\ 1--6. IEEE, 2023
2023
- [13]
-
[14]
The curious case of neural text degeneration
Holtzman, A., Buys, J., Du, L., Forbes, M., and Choi, Y. The curious case of neural text degeneration. arXiv preprint arXiv:1904.09751, 2019
1904 arXiv
-
[15]
Jawahar, G., Abdul-Mageed, M., and Lakshmanan, L. V. Automatic detection of machine generated text: A critical survey. arXiv preprint arXiv:2011.01314, 2020
2011 arXiv
-
[16]
A watermark for large language models
Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. A watermark for large language models. In International Conference on Machine Learning, 2023 a . URL https://api.semanticscholar.org/CorpusID:256194179
2023
-
[17]
On the reliability of watermarks for large language models
Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., and Goldstein, T. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04634, 2023 b
2023 arXiv
-
[18]
Robust distortion-free watermarks for language models
Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593, 2023
2023 arXiv
-
[19]
Crafting papers on machine learning
Langley, P. Crafting papers on machine learning. In Langley, P. (ed.), Proceedings of the 17th International Conference on Machine Learning (ICML 2000), pp.\ 1207--1216, Stanford, CA, 2000. Morgan Kaufmann
2000
-
[20]
Who wrote this code? watermarking for code generation
Lee, T., Hong, S., Ahn, J., Hong, I., Lee, H., Yun, S., Shin, J., and Kim, G. Who wrote this code? watermarking for code generation. Association for Computational Linguistics, 2024. URL https://aclanthology.org/2024.acl-long.268
2024
-
[21]
Starcoder: May the source be with you! arXiv preprint arXiv:2305.06161, 2023
Li, R., Ben Allal, L., Zi, Y., Muennighoff, N., Kocetkov, D., Mou, C., Marone, M., Akiki, C., Li, J., Chim, J., et al. Starcoder: May the source be with you! arXiv preprint arXiv:2305.06161, 2023
2023 arXiv
-
[22]
A semantic invariant robust watermark for large language models
Liu, A., Pan, L., Hu, X., Meng, S., and Wen, L. A semantic invariant robust watermark for large language models. In The Twelfth International Conference on Learning Representations, 2024 a
2024
-
[23]
A survey of text watermarking in the era of large language models
Liu, A., Pan, L., Lu, Y., Li, J., Hu, X., Zhang, X., Wen, L., King, I., Xiong, H., and Yu, P. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57 0 (2): 0 1--36, 2024 b
2024
-
[24]
An entropy-based text watermarking detection method
Lu, Y., Liu, A., Yu, D., Li, J., and King, I. An entropy-based text watermarking detection method. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, 2024
2024
-
[25]
Munyer, T. J. E. and Zhong, X. Deeptextmark: Deep learning based text watermarking for detection of large language model generated text. ArXiv, abs/2305.05773, 2023. URL https://api.semanticscholar.org/CorpusID:258588289
2023 arXiv
-
[26]
Chatgpt: Optimizing language models for dialogue
OpenAI. Chatgpt: Optimizing language models for dialogue. https://openai.com/blog/chatgpt/, November 2022. Accessed: 2024-11-25
2022
-
[27]
Pan, L., Liu, A., He, Z., Gao, Z., Zhao, X., Lu, Y., Zhou, B., Liu, S., Hu, X., Wen, L., King, I., and Yu, P. S. M ark LLM : An open-source toolkit for LLM watermarking. In Hernandez Farias, D. I., Hope, T., and Li, M. (eds.), Proceedings of the 2024 Conference on Empirical Me...
2024 doi
-
[28]
Pan, L., Liu, A., Lu, Y., Gao, Z., Di, Y., Huang, S., Wen, L., King, I., and Yu, P. S. Waterseeker: Pioneering efficient detection of watermarked segments in large documents. arXiv preprint arXiv:2409.05112, 2024 b
2024 arXiv
-
[29]
Y., Wong, K., and Chee, K
Por, L. Y., Wong, K., and Chee, K. O. Unispach: A text-based data hiding method using unicode space characters. Journal of Systems and Software, 85 0 (5): 0 1075--1082, 2012. doi:10.1016/j.jss.2011.12.023
2012 doi
-
[30]
W., Xu, T., Brockman, G., McLeavey, C., and Sutskever, I
Radford, A., Kim, J. W., Xu, T., Brockman, G., McLeavey, C., and Sutskever, I. Robust speech recognition via large-scale weak supervision. In International conference on machine learning, pp.\ 28492--28518. PMLR, 2023
2023
-
[31]
Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., and Liu, P. J. Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res., 21 0 (1), January 2020. ISSN 1532-4435
2020
-
[32]
A robust semantics-based watermark for large language model against paraphrasing
Ren, J., Xu, H., Liu, Y., Cui, Y., Wang, S., Yin, D., and Tang, J. A robust semantics-based watermark for large language model against paraphrasing. In Findings of the Association for Computational Linguistics: NAACL 2024. Association for Computational Linguistics, 2024. doi:1...
2024 doi
-
[33]
Embarrassingly simple text watermarks
Sato, R., Takezawa, Y., Bao, H., Niwa, K., and Yamada, M. Embarrassingly simple text watermarks. arXiv preprint, 2023
2023
-
[34]
Topkara, U., Topkara, M., and Atallah, M. J. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions. In Proceedings of the 8th Workshop on Multimedia and Security, pp.\ 164--174, 2006
2006
-
[35]
Llama: Open and efficient foundation language models
Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozi \`e re, B., Goyal, N., Hambro, E., Azhar, F., Rodriguez, A., Joulin, A., Grave, E., and Lample, G. Llama: Open and efficient foundation language models. ArXiv, abs/2302.13971, 2023. URL https...
2023 arXiv
-
[36]
Waterbench: Towards holistic evaluation of watermarks for large language models
Tu, S., Sun, Y., Bai, Y., Yu, J., Hou, L., and Li, J. Waterbench: Towards holistic evaluation of watermarks for large language models. arXiv preprint arXiv:2311.07138, 2023
2023 arXiv
-
[37]
Towards codable text watermarking for large language models
Wang, L., Yang, W., Chen, D., Zhou, H., Lin, Y., Meng, F., Zhou, J., and Sun, X. Towards codable text watermarking for large language models. arXiv preprint arXiv:2307.15992, 2023
2023 arXiv
-
[38]
Fairness feedback loops: training on synthetic data amplifies bias
Wyllie, S., Shumailov, I., and Papernot, N. Fairness feedback loops: training on synthetic data amplifies bias. In The 2024 ACM Conference on Fairness, Accountability, and Transparency, pp.\ 2113--2147, 2024
2024
-
[39]
Tracing text provenance via context-aware lexical substitution
Yang, X., Zhang, J., Chen, K., Zhang, W., Ma, Z., Wang, F., and Yu, N. Tracing text provenance via context-aware lexical substitution. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp.\ 11613--11621, 2022
2022
-
[40]
Watermarking text generated by black-box language models
Yang, X., Chen, K., Zhang, W., Liu, C., Qi, Y., Zhang, J., Fang, H., and Yu, N. Watermarking text generated by black-box language models. arXiv preprint, 2023
2023
-
[41]
Advancing beyond identification: Multi-bit watermark for large language models
Yoo, K., Ahn, W., and Kwak, N. Advancing beyond identification: Multi-bit watermark for large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Pape...
2024 doi
-
[42]
V., et al
Zhang, S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C., Diab, M., Li, X., Lin, X. V., et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068, 2022
2022 arXiv
-
[43]
Provable robust watermarking for ai-generated text
Zhao, X., Ananth, P., Li, L., and Wang, Y.-X. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439, 2023
2023 arXiv
-
[44]
write newline
" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.