DERMARK: A Dynamic, Efficient and Robust Multi-bit Watermark for Large Language Models

Chen Tang; Junyang Zhang; Lan Zhang; Qihao Lin; Xiangyang Li

REVIEW 4 major objections 5 minor 15 references

DERMARK: A Dynamic, Efficient and Robust Multi-bit Watermark for Large Language Models

T0 review · 4 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read DERMARK's central claim is that multi-bit LLM watermarks should be embedded bit-by-bit into variable-length segments that are closed exactly when a normal-approximation inequality certifies the bit, yielding roughly 25% fewer tokens per…

desk verdict The dynamic segmentation idea is worth a look, but the formal guarantee in Theorem 1 does not hold as written: Lemma 2 assumes token independence, and Algorithm 1's Eq. (11) has a sign flipped relative to Eq. (5). read the letter →

arxiv 2502.05213 v2 pith:FEH27RWD submitted 2025-02-04 cs.CR cs.AI

Qihao Lin , Chen Tang , Lan zhang , Junyang zhang , Xiangyang Li This is my paper · ORCID

classification cs.CRcs.AI

keywords multi-bitwatermarkinglargelanguagemodelswatermarkcapacitydynamicsegmentationtextattributionlogitperturbationPoisson-binomialdistributionrobust

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DERMARK is a multi-bit watermarking method for LLM-generated text. Instead of dividing generated text into fixed-length segments, one per watermark bit, as prior methods do, DERMARK grows each segment token by token and closes it only when a statistical inequality says the bit has been embedded with confidence at least 1−α. The inequality comes from treating the number of tokens that land in the intended color list as a Poisson-binomial sum, which the paper argues is approximately normal. The paper reports that this dynamic segmentation needs about 25% fewer tokens per embedded bit, cuts embedding time roughly in half, and stays robust to insertions, deletions, and paraphrase-style erasure attacks when combined with existing one-bit watermarking. A sympathetic reading is that variable-length segmentation, guided by a per-step confidence test, is the right way to spend a text's entropy budget.

What carries the argument

The load-bearing object is the acceptance inequality Eq. (5), derived from Lemma 2: the aligned-token count in a segment is a Poisson-binomial sum and, by the central limit theorem, approximately normal. In plain terms, the machine is a per-segment statistical test—'has enough of the recent tokens landed in the color list I wanted?'—that the generator polls at every decoding step, closing the segment exactly when the test passes at confidence 1−α. Extraction uses the mirror image of the same statistics: a dynamic program over candidate segment boundaries minimizing Eq. (9), the squared deviation from the tight inequality plus a color-imbalance penalty, with two bias-correction terms (ε_s, ε_c) re-estimated iteratively.

What would settle it

Generate many fixed-length watermarked segments from an autoregressive LLM with a known bit and count how often the majority color decodes to the wrong bit; if the empirical bit-error rate substantially exceeds the α promised by Eq. (5), or if the sequence of aligned-token indicators shows clear autocorrelation, the independence assumption behind the normal approximation is violated.

Watch

Extended reading notes

Core claim

The paper's central claim is that watermark embedding through logit perturbation has a tractable statistical description: for a segment of N generated tokens, the fraction T of tokens that fall in the color list matching the current bit is approximately normal with mean (Σ E[P'(t)])/N and variance (Σ (E[P'(t)] − $E^{2}$[P'(t)]))/$N^{2}$. From this normal approximation the paper derives the condition Φ−1(1−α) ≤ (E[T] − 1/2)/√Var(T) for accepting a segment as having embedded its bit with confidence at least 1−α. DERMARK uses this condition online during generation: it appends tokens to the current segment, and when the inequality holds the segment closes and the next bit begins. On extraction, the paper re-segments the received text with dynamic programming, minimizing a sum of a segmentation loss (how far each candidate segment's statistics are from the tight inequality) and a color loss (how imbalanced red/green counts are), which the authors show yields robustness to small insertions and deletions. The experiments on OPT-1.3B and LLaMA-2-7B compare favorably against Balance-Marking, the fixed-length baseline.

Load-bearing premise

The confidence calculation assumes that, for each generated token, the event that it falls in the half of the vocabulary favored by the current watermark bit is statistically independent of the same event for other tokens; in autoregressive models, each token's probabilities depend on the tokens before it, so if that dependence is strong, the normal approximation and the claimed confidence level are not guaranteed.

Editorial extensions

If this is right

For the same detection rate, DERMARK needs fewer tokens per bit: on average 2.26 fewer on OPT-1.3B and 3.7 fewer on LLaMA-2-7B, and about 25% fewer per embedded bit overall.
Embedding overhead is close to raw generation because segmentation uses only logits already computed; the reported time is under half that of the Balance-Marking baseline.
Robustness to 5–10% random insertions and deletions is maintained because extraction re-segments via dynamic programming instead of relying on boundaries fixed at embed time.
Since DERMARK only decides where segments start and stop, it can wrap any one-bit watermarking scheme, so robustness upgrades against paraphrasing can be dropped in without changing the segmentation logic.
On low-entropy text (the worst-performing 25% of samples) the capacity advantage grows: at least 5 fewer tokens per bit for the same detection rate, and the baseline plateaus near 0.88 detection while DERMARK continues past 0.95.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the independence assumption behind the normal approximation is noticeably violated in real autoregressive models, DERMARK's reported numbers may still hold in practice; the inequality would then act as a heuristic confidence screen rather than an exact probability guarantee, and the natural check is to compare empirical bit-error rates with the claimed α.
The same normal-approximation inequality could be reused outside multi-bit watermarking, for example to decide how many tokens are needed to certify any per-token binary property at a target confidence during generation.
A variable-length watermark variant falls out directly: instead of fixing the number of bits, keep opening new segments until the text runs out, which the paper notes is the natural use of its real-time capacity assessment.
Because segmentation is driven by observed green/red counts within the current segment, the method implicitly adapts to the empirical color balance of the generated text, which may explain its robustness on low-entropy, code-like text where the model's logits are highly peaked.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First, the thing to know: the methodological core—adaptive, entropy-guided segmentation for multi-bit watermarks—is genuinely new relative to the fixed-length baselines, and the implementation looks clean. But the theory that supposedly justifies it is broken in two separate places, and the paper's central claim that it 'formally shows' a closed-form capacity estimate is not true as written.

What's good: the segmentation mechanism is a real contribution. Different texts have different token-level capacity, and adapting segment length per bit makes intuitive sense. The empirical results against Balance-Marking show consistent gains in tokens-per-bit, and the overhead numbers on OPT-1.3b, LLaMA-2-7b, and LLaMA-2-70b are believable. The authors also release code, which is more than many papers in this area do. The explicit discussion of why they chose Balance-Marking over MPAC is honest—though it doesn't excuse the absence of a direct comparison.

The soft spots are not minor. Lemma 2 asserts that the token-color indicators P'(t) are mutually independent. In autoregressive generation, token probabilities depend on all previous tokens, so this is false. The proof says 'Since token generation is independent'—which is simply wrong for this setting. Without independence, the Poisson-binomial CLT does not follow. A martingale or concentration inequality for dependent variables might salvage the result, but the paper does not.

Second, the sign flip. Theorem 1 (Eq. 5) gives the condition as Φ^{-1}(1−α) ≤ (E[T]−1/2)/√Var(T). Algorithm 1 and Eq. (11) state the stopping rule as Φ^{-1}(1−α) ≤ (1/2−E[T])/√Var(T). These are incompatible except at E[T]=1/2. For a segment with expected aligned proportion below 0.5, Eq. (5) rejects while Eq. (11) accepts. So the implemented algorithm does not have the claimed confidence guarantee. This is a direct internal contradiction, not a judgment call.

There is also circularity: Eq. (6) estimates Pk1 and Pk0 from the green and red token counts inside the segment that is still being built. So the stopping rule uses the data it is supposed to predict. That doesn't make the method worthless—it might work as a heuristic—but it kills the 'closed-form prediction' claim.

The capacity curves sweep α, which directly controls the stopping threshold, so the reported capacity gain is partly built into the parameter. And the baseline is a single curated comparison; the paper omits a direct run against MPAC, which is the most recent multi-bit method discussed in its own Related Work.

Who is this for? Researchers working on LLM watermarking and attribution. If the theory were repaired, the segmentation idea would be useful. As it stands, the paper needs major revision. A serious referee should not desk-reject it—the problem and the mechanism are worth engaging—but they should send it back for a rewrite with a correct theorem or a clearly stated heuristic justification, plus a direct comparison with MPAC.

Recommendation: accept for peer review with the expectation of heavy revision; do not trust the formal guarantees as written.

Referee Report

4 major / 5 minor

Summary. The paper proposes DERMARK, a multi-bit LLM watermarking method that dynamically partitions generated text into variable-length segments, one per watermark bit, using a stopping rule derived from a claimed normal approximation of the fraction of tokens aligned with the embedded bit. The authors state a theorem (Theorem 1) giving a confidence guarantee for the stopping inequality, an embedding algorithm based on that inequality, a dynamic-programming extraction procedure, and experiments on OPT-1.3B and LLaMA-2-7B comparing against Balance-Marking. The manuscript also includes an appended limitations section and a detailed justification for the baseline choice.

Significance. If the theoretical foundation were sound, dynamic entropy-aware segmentation would be a meaningful step beyond fixed-length multi-bit watermarking, and the reported capacity and efficiency gains would be of practical interest. The paper also makes a positive effort toward reproducibility by releasing code and reporting experimental setups. However, the central formal claim is invalid as stated: the implemented stopping rule contradicts the theorem's inequality, the independence assumption behind the normal approximation does not hold for autoregressive generation, and the estimation procedure is circular. Because these issues directly undermine the claimed confidence guarantee, the contribution cannot be accepted on the current evidence.

major comments (4)

[Theoretical Derivation, Eq. (5) and Algorithm 1, Eq. (11)] There is a direct sign inconsistency between the theorem and the algorithm. Theorem 1 and Eq. (5) require Phi^{-1}(1-alpha) <= (E[T]-1/2)/sqrt(Var(T)), which is equivalent to P(T>1/2) >= 1-alpha. However, Algorithm 1 and the surrounding text state the stopping condition as Eq. (11): Phi^{-1}(1-alpha) <= (1/2-E[T])/sqrt(Var(T)). These two inequalities are mutually incompatible except when E[T]=1/2. For example, with N=100 and E[T]=0.45, the left side of Eq. (5) is about -1.005, so Eq. (5) is false at alpha=0.8, while the right side of Eq. (11) is about 1.005, so Eq. (11) is true. Since Algorithm 1 explicitly uses Eq. (11), the confidence guarantee of Theorem 1 does not apply to the implemented method as written; one of the two is wrong.
[Lemma 2 proof] The proof of Lemma 2 asserts that the indicators P'(t) are mutually independent 'since token generation is independent.' This is false for autoregressive LLMs: the logits at step t depend on all previously sampled tokens, and in Algorithm 1 the green/red partition is seeded by the previous token s(t-1), so P'(t) depends on earlier tokens and hence on earlier P'(j). The sequence {P'(t)} is not a sum of independent Bernoulli variables, so the Poisson-binomial CLT invoked from Tang and Tang (2023) does not apply. Consequently the normal approximation in Eq. (3), the derivation of Eqs. (4)-(5), and Theorem 1 are unsupported.
[DERMARK, Multi-bit Watermark Embedding, Eq. (6)] The estimation of E[P'(t)] is circular. To evaluate the stopping inequality Eq. (5), the paper estimates Pk1 and Pk0 using the observed green and red token counts within the current segment (Eq. (6)), and then uses those estimates to compute E[P'(t)] and hence E[T] in Eq. (5). The same observed counts that are being tested for statistical sufficiency are used to construct the test statistic. A segment with an early run of aligned tokens can satisfy Eq. (5) merely because that run raises the estimated Pk1, not because the underlying entropy justifies the confidence claim. The capacity experiments in Fig. 3 sweep alpha, which directly sets the stopping threshold, so the resulting capacity curves do not independently validate the theoretical segmentation criterion.
[Experiments and Baseline Selection] The experimental comparison is limited to a single baseline, Balance-Marking, against which comparisons are favorable; the appended 'Baseline Selection' section argues that MPAC is weaker but provides no experimental comparison with MPAC or any other recent multi-bit method. The abstract and introduction claim 'SOTA' improvements, but the evidence does not establish superiority over the broader set of multi-bit watermarking baselines. In addition, the robustness evaluation covers only 5% and 10% insertion/deletion attacks; there are no experiments on paraphrasing or watermark erasure, despite the paper's claim of robustness against erasure attacks, and the Limitations section explicitly concedes vulnerability to aggressive modifications and copy-paste attacks.

minor comments (5)

[Eq. (7)] Equation (7) has typesetting and clarity issues: the expression '(Phi^{-1}(1-alpha))2' is missing a superscript formatting, and the function f(E[P'(t)]) is written without an explicit subscript but used per-segment; please define all quantities and correct the parentheses.
[Algorithm 1] The pseudocode contains several errors: line 1 says 'Append the (1 - M[k-1]) token to M' when it presumably means the inverse bit; the condition 'if i <= k' on line 14 should compare against the length of M; and terms such as 'soft watermark method' and the seeding of G/R by s(t-1) are not defined consistently with the notation in Section 'Notations and Preliminaries'.
[Table 2] The perplexity results in Table 2 show large fluctuations between settings (e.g., delta=0.8 on LLaMA-2-7b: 197 for DERMARK versus 144 for Balance-Marking), but no variance, confidence intervals, or significance tests are reported, so the claim of 'comparable text quality' is not statistically supported.
[Experiments, Capacity Comparison] The capacity curves in Fig. 3 are constructed by varying alpha for DERMARK and segment length for the baseline, then plotting the resulting detection rate against the measured tokens-per-bit; this is not a controlled comparison at matched operating points, and it would strengthen the paper to report operating curves with confidence bands and a matched detection-rate analysis.
[Limitations] The Limitations section states that the method 'is not robust against aggressive text modifications, such as copy-paste attacks, heavy perturbations, or more sophisticated text sanitization techniques,' which is in tension with the abstract's claim of 'high robustness against text modifications and watermark erasure attacks'; the paper should scope the robustness claims consistently.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: Eq. (6) is plug-in estimation and the stopping rule is not forced; the Eq. (5)/Eq. (11) sign inconsistency is a correctness bug, not circularity.

full rationale

None of the load-bearing steps reduces to its own input by construction. Lemma 1 is an exact algebraic identity from the logit perturbation. Lemma 2 applies the Poisson-binomial CLT; the proof's assertion that 'token generation is independent' is an unjustified assumption for autoregressive generation, but an unproven assumption is not a circular reduction. Eqs. (4)-(5) and Theorem 1 are arithmetic rearrangements of the normal-tail condition; Theorem 1 restates the confidence condition rather than independently predicting segment length, but this is a formal equivalence, not a definitional smuggling of the conclusion. Eq. (6) estimates the bit prior from observed green/red counts within the current segment; this is plug-in estimation inside a sequential stopping rule. The resulting stopping time is the method's design, and the inequality can fail for a given segment, so the criterion is not forced by construction. The extraction procedure's iterative updates of epsilon_s and epsilon_c tune nuisance parameters; the extracted bits are determined by color majority, not by the fitted residuals. There are no load-bearing self-citations: the CLT citation and the Kirchenbauer et al. one-bit method are independent external inputs. The paper does contain a serious formal inconsistency that is not circular: Algorithm 1's Eq. (11) uses (1/2 - E[T])/sqrt(Var(T)), the negative of Eq. (5)'s z-score, so the implemented stopping condition contradicts Theorem 1 as written; Eq. (7)'s squared loss also cannot distinguish the sign of the z-score. These are correctness risks, not circularity, and therefore do not raise the circularity score.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The method rests on several tuned numeric hyperparameters and on an independence assumption that is violated by the targeted system. No new physical entities are introduced.

free parameters (6)

alpha (significance level) = swept in [0.8, 0.99]
Controls the strictness of the segmentation inequality and directly determines tokens per bit; capacity curves are generated by sweeping it.
beta = 34
Weight between segmentation loss and color loss in Eq. (9); chosen after 'extensive experimentation'.
lambda = alpha * (Phi^-1(alpha))^2
Smoothing hyperparameter in Eq. (6) for estimating bit priors; manually tuned for numerical stability.
epsilon_s = iteratively updated from data
Bias-correction term in segmentation loss; updated from the current segmentation until convergence.
epsilon_c = iteratively updated from data
Bias-correction term for color imbalance; updated from observed token-type deviations.
delta (watermark strength) = default 1, swept 0.5 to 2.0
Logit bias strength; standard in KGW, but swept in Table 1 and varied across quality experiments.

assumptions (4)

domain assumption The token-color indicators P'(t) are mutually independent.
Stated in Proof of Lemma 2 as 'Since token generation is independent'; false for autoregressive LLMs where logits and vocabulary splits depend on previous tokens.
standard math Poisson-binomial CLT applies to the sum of these indicators.
Valid for independent Bernoulli variables, but the independence condition is not met, so the CLT does not justify the normal approximation.
ad hoc to paper E[P'(t)] in Eq. (5) can be estimated from observed green and red counts within the current segment.
Eq. (6) uses empirical counts in the same segment being decided, making the segmentation feedback-dependent rather than a prior estimate.
ad hoc to paper The significance level alpha yields embedding confidence 1 - alpha.
Theorem 1 asserts this, but the derivation relies on an invalid normal approximation and the sign inconsistency in Eq. (11) undermines the threshold.

how reviews work

0 comments

Cite this review

Pith. "Pith review of DERMARK: A Dynamic, Efficient and Robust Multi-bit Watermark for Large Language Models." pith.science (2026). https://pith.science/paper/FEH27RWD

@misc{pith2026250205213,
  author       = {Pith},
  title        = {Pith review of: DERMARK: A Dynamic, Efficient and Robust Multi-bit Watermark for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FEH27RWD}},
  note         = {Machine review of arXiv:2502.05213}
}

read the original abstract

As large language models (LLMs) grow more powerful, concerns over copyright infringement of LLM-generated texts have intensified. LLM watermarking has been proposed to trace unauthorized redistribution or resale of generated content by embedding identifiers within the text. Existing approaches primarily rely on one-bit watermarking, which only verifies whether a text was generated by a specific LLM. In contrast, multi-bit watermarking encodes richer information, enabling the identification of the specific LLM and user involved in generated or distributed content. However, current multi-bit methods directly embed the watermark into the text without considering its watermark capacity, which can result in failures, especially in low-entropy texts. In this paper, we analyze that the watermark embedding follows a normal distribution. We then derive a formal inequality to optimally segment the text for watermark embedding. Building upon this, we propose DERMARK, a dynamic, efficient, and robust multi-bit watermarking method that divides the text into variable-length segments for each watermark bit during the inference. Moreover, DERMARK incurs negligible overhead since no additional intermediate matrices are generated and achieves robustness against text editing by minimizing watermark extraction loss. Experiments demonstrate that, compared to SOTA, on average, our method reduces the number of tokens required per embedded bit by 25\%, reduces watermark embedding time by 50\%, and maintains high robustness against text modifications and watermark erasure attacks.

Figures

Figures reproduced from arXiv: 2502.05213 by the authors.

**Figure 1.** Multi-bit Watermarking Pipeline. by an LLM during its inference process. As previously discussed, we divide the text into segments, each dedicated to encoding a single bit. Accordingly, the embedding procedure can be conceptually divided into two steps: Step 1. Segmentation: Partition the generated text into segments, each segment corresponding to one watermark bit. Step 2. Embedding: Embed each bit into its corr… view at source ↗

**Figure 2.** Workflow of DERMARK. Lemma 2. T ∼ N ( µ N , σ 2 N2 ), (3) µ = X N t=1 E[P ′(t) ], σ2 = X N t=1 (E[P ′(t) ] − E 2 [P ′(t) ]). Proof. {P ′(t)} N t=1 are mutually independent (not identically distributed). Therefore, X follows a Poisson binomial distribution, i.e., the sum of independent Bernoulli variables. From the properties of the Poisson binomial distribution, we have: E[X] = X N t=1 E[P ′(t) ], Var(X) = X N t=1 … view at source ↗

**Figure 3.** Capacity Comparison. Each scatter point in figure is measured over 500 samples under different preset [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Robustness comparison. Each scatter point in figure is measured over 500 samples under different preset [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: Comparison of time cost in text generation (left) [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: Capacity Comparison across high-entropy dataset [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

**Figure 7.** Figure 7: Comparison of time cost in text generation and [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 8 canonical work pages

[1]

Gpt-4 technical report

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 , 2023

arXiv 2023
[2]

Model leeching: An extraction attack targeting llms

Lewis Birch, William Hackett, Stefan Trawicki, Neeraj Suri, and Peter Garraghan. Model leeching: An extraction attack targeting llms. arXiv preprint arXiv:2309.10544 , 2023

arXiv 2023
[3]

Can llm-generated misinformation be detected? In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024

Canyu Chen and Kai Shu. Can llm-generated misinformation be detected? In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024 . OpenReview.net, 2024

work page 2024
[4]

Llama 2: Open foundation and fine-tuned chat models

Meta GenAI. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 , 2023

arXiv 2023
[5]

Unbiased watermark for large language models, 2023

Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models, 2023

work page 2023
[6]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning , pages 17061--17084. PMLR, 2023

work page 2023
[7]

A semantic invariant robust watermark for large language models, 2024

Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models, 2024

2024
[8]

A survey of text watermarking in the era of large language models

Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys , 57(2):1--36, 2024

work page 2024

Show all 15 references

[9]

Academic integrity considerations of ai large language models in the post-pandemic era: Chatgpt and beyond

Mike Perkins. Academic integrity considerations of ai large language models in the post-pandemic era: Chatgpt and beyond. Journal of University Teaching and Learning Practice , 20(2), 2023

2023
[10]

Language models are unsupervised multitask learners

Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog , 1(8):9, 2019

2019
[11]

Exploring the limits of transfer learning with a unified text-to-text transformer

Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research , 21(140):1--67, 2020

2020
[12]

The poisson binomial distribution—old & new

Wenpin Tang and Fengmin Tang. The poisson binomial distribution—old & new. Statistical Science , 38(1):108--119, 2023

2023
[13]

Towards codable watermarking for injecting multi-bits information to llms

Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. Towards codable watermarking for injecting multi-bits information to llms. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 20...

2024
[14]

Opt: Open pre-trained transformer language models

Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068 , 2022

2022 arXiv
[15]

\ REMARK-LLM \ : A robust and efficient watermarking framework for generative large language models

Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushanfar. \ REMARK-LLM \ : A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 1813--1830, 2024

2024

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.

[1] [1]

Gpt-4 technical report

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 , 2023

arXiv 2023

[2] [2]

Model leeching: An extraction attack targeting llms

Lewis Birch, William Hackett, Stefan Trawicki, Neeraj Suri, and Peter Garraghan. Model leeching: An extraction attack targeting llms. arXiv preprint arXiv:2309.10544 , 2023

arXiv 2023

[3] [3]

Can llm-generated misinformation be detected? In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024

Canyu Chen and Kai Shu. Can llm-generated misinformation be detected? In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024 . OpenReview.net, 2024

work page 2024

[4] [4]

Llama 2: Open foundation and fine-tuned chat models

Meta GenAI. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 , 2023

arXiv 2023

[5] [5]

Unbiased watermark for large language models, 2023

Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models, 2023

work page 2023

[6] [6]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning , pages 17061--17084. PMLR, 2023

work page 2023

[7] [7]

A semantic invariant robust watermark for large language models, 2024

Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models, 2024

2024

[8] [8]

A survey of text watermarking in the era of large language models

Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys , 57(2):1--36, 2024

work page 2024