Pith. sign in

REVIEW 4 major objections 6 minor 3 cited by

BiMark: Unbiased Multilayer Watermarking for Large Language Models

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a fair-coin-flip reweighting mechanism, stacked across multiple vocabulary partitions, lets large language models carry multi-bit provenance messages in their output text without the quality loss that biased…

desk verdict The bit-flip reweighting is elegant and provably unbiased, but the paper's per-bit accuracy numbers do not support the claimed multi-bit message capacity. read the letter →

arxiv 2506.21602 v2 pith:OEGRCHMM submitted 2025-06-19 cs.CL cs.AI

Xiaoyan Feng , He Zhang , Yanjun Zhang , Leo Yu Zhang , Shirui Pan This is my paper · ORCID
classification cs.CLcs.AI
keywords LLMwatermarkingmulti-bitunbiasedreweightingmodel-agnosticdetectionmessageextractiontextqualitypreservationXORone-timepadmultilayer
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that BiMark is a watermarking framework that combines, for the first time, unbiased text generation with multi-bit message embedding, model-agnostic detection, and message-agnostic extraction. The motivating problem is that existing schemes trade one of these properties for another: biased methods like Soft Red List and MPAC sacrifice text quality for detection strength, while unbiased methods preserve quality but either cannot carry messages or require access to model probabilities. BiMark's answer is a bit-flip unbiased reweighting function, a multilayer version of it, and an XOR-based one-time pad that turns message bits into fair coin flips. If the claim is right, practical deployment becomes easier because watermarked text is statistically indistinguishable in quality from unwatermarked text while still carrying provenance metadata, and detection works on short texts where earlier multi-bit methods struggle. The experiments report up to 30% higher extraction rates than MPAC on 50-token texts and downstream summarization and translation scores matching unwatermarked text.

What carries the argument

The load-bearing object is the bit-flip unbiased reweighting function $R_{\theta,e}$: a token-counting reweighting that splits the vocabulary into two equal halves $V_0,V_1$, flips a fair coin $e$, multiplies the probability of tokens in one half by $(1+\delta_1)$ and the other by $(1-\delta_0)$, and thereby leaves the expected distribution unchanged while making the direction of the bias detectable from token membership alone. A sequence of $d$ independent such functions composes into the multilayer reweighting mechanism, and an XOR-enhanced position allocation hides message bits by setting each layer's coin flip to $m[p] \oplus b_i$, where $b_i$ is a pseudorandom Bernoulli(0.5) one-time-pad bit; because XOR with a random bit is itself Bernoulli(0.5), the message content never breaks unbiasedness. Detection reconstructs the partition memberships pseudorandomly, gathers votes for each message position in an $\ell \times 2$ voting matrix, and recovers each bit by majority vote.

What would settle it

Run BiMark with a 32-bit message on deliberately low-entropy generations, such as forced repetition or near-deterministic continuations, and measure the extraction rate against the prediction from the paper's Type-II formula; if the rate collapses toward 50% as the average $\tau_t$ nears 0 or 1, the coexistence of message capacity and quality holds only for high-entropy text.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a symmetric probability reweighting controlled by fair coin flips can carry multi-bit messages without a quality trade-off. Instead of permanently boosting a green list, the method chooses which half of the vocabulary gets boosted by a fair coin flip $e$, and that coin flip is itself a message bit $m[p]$ XORed with a pseudorandom one-time-pad bit $b_i$; repeating this across $d$ independent vocabulary bipartitions creates a multilayer statistical fingerprint. The central identity is the unbiasedness theorem $\mathbb{E}_e[R_{\theta,e}(P_M)] = P_M$, which holds because each token's probability is multiplied by $(1+\delta_1)$ or $(1-\delta_0)$ with equal probability while $\delta_0 = \delta_1 \tau/(1-\tau)$ keeps the distribution normalized. The paper argues this preserves text quality by construction, enables model-agnostic detection because detection needs only token subset memberships, and supports message-agnostic extraction because the XOR is reversible.

Load-bearing premise

The load-bearing premise is that the per-token statistical bias created by the reweighting, $\mathbb{E}[G_t] = 0.5 + \tilde{\delta}\tau_t$, stays large enough over the text length and layer count for majority voting to recover every message bit; the paper's own Type-II analysis shows the bias shrinks toward zero as the partition probability mass $\tau_t$ approaches 0 or 1, so the guarantee rests on the generated text being sufficiently high-entropy.

Editorial extensions

If this is right

  • For short texts, BiMark turns provenance tagging from unreliable to workable: on 50-token outputs it reports 8-bit extraction rates of 95.26% versus 49.49% for MPAC(1), and the gap grows with message length.
  • Watermark strength becomes a tunable knob: increasing the number of layers or the base scaling factor $\tilde{\delta}$ raises detectability up to a peak, after which extra layers add noise rather than signal.
  • Multilayer reweighting leaves multiple independent statistical traces, so the method degrades more gracefully under synonym substitution; under a 30% substitution ratio on 100-token texts, BiMark keeps extraction rates 26.24% higher than MPAC.
  • Because extraction is message-agnostic, the same detection procedure recovers any embedded bit-string without enumerating the message space, which is what a practical provenance service needs for model identity, timestamps, and content metadata.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: if the per-layer unbiasedness theorem composes to full-sequence undetectability, BiMark would match the theoretical guarantees of other unbiased schemes while adding message capacity; the paper reports perplexity and downstream task scores but does not run a formal n-shot undetectability test, so that guarantee is not yet demonstrated.
  • Editorial extension: the Type-II analysis predicts the watermark signal is proportional to the probability mass $\tau_t$ of a vocabulary partition, which means low-entropy, repetitive, or near-deterministic text should be a failure mode; a stress test on such text would show how wide the method's actual deployment envelope is.
  • Editorial extension: the voting-matrix extraction is effectively a repetition code over layers and tokens, so wrapping the message in an error-correcting code, as earlier multi-bit work did for its own scheme, is the natural next step and could push short-text extraction rates close to 100%.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper proposes BiMark, an inference-time LLM watermarking framework that combines (i) a bit-flip unbiased reweighting rule over fixed vocabulary bipartitions, (ii) a multilayer composition of such rules, and (iii) an XOR-based one-time-pad encoding of message bits into the fair coin flips used by the reweighting. The claimed contributions are unbiased text-quality preservation, model-agnostic and message-agnostic detection, and multi-bit message capacity with extraction rates up to 30% higher than MPAC on short texts. The main theoretical result is Theorem 4.2, E_e[R_{θ,e}(P)] = P, supported by the scaling-factor constraint in Lemma 4.1 and the XOR uniform-bit argument in App. A.4. Experiments evaluate extraction rate (per-bit accuracy) and perplexity in Table 2, robustness to token substitution in Table 3, zero-bit detection in Fig. 4, downstream-task quality in Table 4, and ablations in Fig. 5.

Significance. The core unbiasedness mechanism is sound: the proof in App. A.1 is a direct expectation computation that does not depend on fitted parameters, and App. A.4 correctly shows that XOR with a balanced mask produces a fair coin flip regardless of the message content. The paper also provides pseudocode (App. C) and a public repository, which strengthens reproducibility. If the capacity claim can be supported by exact-message recovery metrics, BiMark would be a useful step toward unbiased multi-bit watermarking. However, as detailed below, the current evaluation metric does not establish the central multi-bit capacity claim, and the paper's own Type-II analysis in App. A.2 identifies a low-entropy limitation that is not reflected in the abstract's unqualified claims.

major comments (4)
  1. [§5.1, Table 2] The 'Rate' reported in Table 2 is the ratio of correctly extracted bits, not the probability of recovering the full message. Under the independence assumption and using the paper's own favorable C4/Llama3-8B results, a 32-bit message is recovered exactly with probability about (0.6635)^32 ≈ 2×10^-6 at 50 tokens and (0.9022)^32 ≈ 3.7% at 300 tokens; a 16-bit message is recovered exactly with probability about (0.8555)^16 ≈ 8% at 50 tokens. Because 'multi-bit message embedding capacity' is one of the three central contributions claimed in the abstract and introduction, the paper either needs to report exact-match recovery rates or add error correction and report end-to-end payload recovery. As presented, the evidence in Table 2 does not establish usable multi-bit capacity.
  2. [App. A.2 and §5.1] The Type-II analysis in App. A.2 shows that the per-token bias E[G_t] is 0.5 + δτ_t in the unclipped regime and approaches 0.5 as τ_t tends to 0 or 1, so the watermark signal is weak for low-entropy or repetitive text. The extraction experiments in §5.1, however, use only C4-RealNewslike prompts with temperature-1.0 Llama3-8B generation, which are high-entropy settings. The abstract's unqualified claim that BiMark achieves message embedding capacity is therefore broader than the tested regime; the authors should either benchmark low-entropy domains (e.g., code, repetitive instructions, or greedy decoding) or explicitly scope the claim to high-entropy text.
  3. [§5.1, Tables 2 and 3] The headline quantitative claims rest on single-point estimates. Tables 2 and 3 report no confidence intervals, standard deviations, or number of independent trials, so the 'up to 30% higher extraction rates' figure cannot be distinguished from noise around the point estimates. Please report means with standard deviations or confidence intervals over multiple seeds for the extraction-rate tables.
  4. [§5.1 and §2] The related-work section highlights Qu et al. (2024) as a multi-bit watermarking method with error correction, but Table 2 compares BiMark only with MPAC (and with zero-bit methods in Fig. 4). If Qu et al. is incompatible with the model-agnostic/message-agnostic setting or is not publicly available, the selection criteria in §5.1 should say so; as written, the 'state-of-the-art multi-bit watermarking methods' comparison is incomplete, and the effect of error correction on the exact-recovery shortfall in Table 2 is left unexamined.
minor comments (6)
  1. [Algorithm 2, step 4] The mapping in Algorithm 2 is inverted relative to §4.3: step 4 sets \hat{e}_t^i = 1 when x_t ∈ V_i^0, while §4.3 defines \hat{e}_t^i = 0 for V_i^0 and 1 for V_i^1. Please correct the algorithm.
  2. [Algorithm 2, step 7] Step 7 reads 'm[p] = max(M[p][0], [p][1])', which returns the vote count rather than the bit; this should be an arg max or an explicit index assignment.
  3. [Abstract and §5.1] The 'up to 30% higher extraction rates' claim should be qualified as relative per-bit accuracy for 32-bit messages at 50 tokens against MPAC(1.5), not exact-message recovery; the current phrasing invites a stronger reading.
  4. [Fig. 1 caption] The caption contains corrupted or missing text ('…that …LLM Original probabiltiy distribution'); please repair the rendering and the typo in 'probability'.
  5. [Appendix D] The voting matrices in Appendix D contain non-integer entries such as [44. 12] and [77.6, 66.4], which are inconsistent with an integer vote-count matrix; these are likely typos and should be fixed.
  6. [App. A.3 and Definition 3.1] The paper invokes n-shot undetectability in Definition 3.1 but proves only per-token unbiasedness. Please state explicitly how the context-tracking mechanism in Algorithms 1 and 2 extends the per-token expectation to the sequence-level n-shot property.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the unbiasedness and XOR claims are proved directly from the paper's own definitions.

full rationale

BiMark's derivation chain is self-contained rather than circular. Theorem 4.2 (App. A.1) computes E_e[R_{theta,e}(P_M)(x)] separately for x in V1 and x in V0, obtaining 0.5(1+delta1)P + 0.5(1-delta1)P = P in each case; this is a direct expectation calculation from the reweighting definition and the fair-coin assumption, with no fitted parameter and no use of the target result. The XOR property (App. A.4) is verified by enumerating x=0 and x=1 with b ~ Bernoulli(0.5), so the claim that e = m[p] XOR b is balanced holds independently of the message; message-agnostic extraction therefore does not presuppose that messages are recoverable. Multilayer unbiasedness (App. A.3) is a composition argument resting on independence of the bipartitions and coin flips, again derived within the paper. Scaling factors are constrained by probability normalization (Lemma 4.1) and handled piecewise for boundary cases; they are not fitted to extraction data. Empirical extraction rates in Tables 2-3 are measurements compared against external baselines (MPAC, Soft Red List, SynthID), not quantities forced by the theory. The paper does not invoke a uniqueness theorem, does not smuggle an ansatz in via a citation, and does not rename a known result. A presentation concern exists—Table 2's 'Rate' is per-bit accuracy rather than whole-message exact recovery, which can overstate practical multi-bit capacity—but that is a statistical reporting and correctness issue, not circularity: no derivation in the paper reduces to its own input. Accordingly, the appropriate circularity score is 0.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The method's unbiasedness is a direct consequence of fair coin flips and symmetric scaling; it does not rely on external fitted constants. The extraction performance, however, depends on two user-selected hyperparameters (base scaling factor and number of layers) and on the entropy of the generated text. No invented entities are introduced.

free parameters (3)
  • Base scaling factor δ~ = 1.0 (main experiments)
    Controls per-layer probability boost/penalty; ablated from 0.1 to 1.0. Not fitted to the test data, but directly sets watermark strength and thus extraction rate.
  • Number of layers d = 10 (main experiments)
    Number of independent bipartitions and coin flips per token. Each layer adds one vote per token during extraction, so d multiplies the vote count and is a main driver of the reported gains over MPAC. Ablation shows peak detection near d=10.
  • Sliding window size h = 2 tokens
    Seeds the pseudorandom functions for message-position and mask generation. Standard choice for this watermarking family.
assumptions (3)
  • domain assumption Pseudorandom functions prfp and prfb are secure and behave like independent random oracles.
    Unbiasedness and recoverability rely on masks being uniform Bernoulli(0.5) and partitions being independent of the coin flips. Invoked in Section 4.3 and Algorithms 1 and 2.
  • domain assumption The generated text is high-entropy enough that the probability mass τ of the partition V1 stays away from 0 and 1.
    The per-token signal E[Gt] = 0.5 + δτt requires τt away from extremes; the paper's own A.2 analysis shows the watermark weakens when the model distribution is concentrated on a few tokens.
  • domain assumption The generating model's per-token probability distribution PM is available during embedding.
    The reweighting multiplies PM by (1±δ), so the generator must expose token probabilities. Detection is model-agnostic, but embedding is not.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BiMark: Unbiased Multilayer Watermarking for Large Language Models." pith.science (2026). https://pith.science/paper/OEGRCHMM

@misc{pith2026250621602,
  author       = {Pith},
  title        = {Pith review of: BiMark: Unbiased Multilayer Watermarking for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OEGRCHMM}},
  note         = {Machine review of arXiv:2506.21602}
}
read the original abstract

Recent advances in Large Language Models (LLMs) have raised urgent concerns about LLM-generated text authenticity, prompting regulatory demands for reliable identification mechanisms. Although watermarking offers a promising solution, existing approaches struggle to simultaneously achieve three critical requirements: text quality preservation, model-agnostic detection, and message embedding capacity, which are crucial for practical implementation. To achieve these goals, the key challenge lies in balancing the trade-off between text quality preservation and message embedding capacity. To address this challenge, we propose BiMark, a novel watermarking framework that achieves these requirements through three key innovations: (1) a bit-flip unbiased reweighting mechanism enabling model-agnostic detection, (2) a multilayer architecture enhancing detectability without compromising generation quality, and (3) an information encoding approach supporting multi-bit watermarking. Through theoretical analysis and extensive experiments, we validate that, compared to state-of-the-art multi-bit watermarking methods, BiMark achieves up to 30% higher extraction rates for short texts while maintaining text quality indicated by lower perplexity, and performs comparably to non-watermarked text on downstream tasks such as summarization and translation.

Figures

Figures reproduced from arXiv: 2506.21602 by the authors.

Figure 1
Figure 1. Pipeline of BiMark. a) The LLm outputs a probability distribution over all tokens (grey lines). b) The message embedding process (red lines) modifies this distribution using a pseudorandom function that selects message bits and generates one-time pad masks. After XOR operations create fair coin flips, multilayer unbiased reweighting guides token sampling. c) Message extraction (green lines) reconstructed the message… view at source ↗
Figure 2
Figure 2. Bit-flip unbiased reweighting. Given a vocabulary bipar￾tition V0 (shown in yellow) and V1 (shown in blue), a probability distribution PM over the vocabulary V is adjusted based on a fair coin flip e. When e = 0, probabilities of V0 is increased by δ0% and probabilities of V1 is decreased by δ1%. When e = 1, probabilities of V1 is increased by δ1% and probabilities of V0 is decreased by δ0%. This symmetric adjustmen… view at source ↗
Figure 3
Figure 3. Multilayer bit-flip reweighting. Given multiple bipar￾titions, each reweighting layer adjusts the probability from the previous reweighting layer based on the bipartition and the fair coin flip result of this layer. In layer 1, “Sunny” belongs to V1 and e = 1, making “Sunny” become green and gain probability. In layer 2, “Sunny” belongs to V0 and e = 0, making “Sunny” become green and gain probability. In layer 3, “… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Zero-bit Watermark Detection. evident with both shorter texts and longer messages, which typically present greater challenges in watermarking. We further evaluate resilience against synonym substitution attacks (Jovanovic et al. ´ , 2024; Zhang et al., 2024d; Hou et al…
Figure 5
Figure 5. Figure 5: Ablation experiments of multilayer reweighting. with increased layers, slightly decreases after reaching a peak, but remains superior to single-layer approaches. As shown in App. A.2, watermark detectability depends on the base scaling factor ˜δ and probability balance…
Figure 6
Figure 6. Figure 6: The complete process of BiMark. The right part shows original LLM text generation. The watermark embedding process begins when the LLM outputs an original probability distribution PM. Step A pseudorandomly selects a message bit m[p]. Step B samples d independent balanc…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

    cs.CR 2026-07 accept novelty 7.0 of 10

    TRACE is a two-channel, distortion-free agent watermark whose selection and tally layers jointly resist deletion and rewriting by a log-holding reseller.

  2. Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

    cs.CR 2026-08 conditional novelty 6.0 of 10

    A dual-signal LLM watermark co-embeds a robust and a fragile signal into every token, enabling three-state detection of intact, tampered, and unwatermarked text.

  3. Toward Stronger Code Watermarking: A Grammar-Driven Approach to Optimizing the Trade-off Between Quality and Detectability

    cs.CR 2026-07 conditional novelty 5.5 of 10

    Grammar-guided three-level masking plus role-aware logit bias and weighted detection improves the code quality–watermark detectability frontier over KGW, SWEET, EWD, STONE, CodeIP, and SynthID-Text.

Reference graph

Works this paper leans on

28 extracted references · 20 canonical work pages · cited by 3 Pith papers

  1. [1]

    V ocabulary bipartitions(V i 0, V i

    work page

  2. [2]

    Fair coin flip ei is independent of ei+1

    work page

  3. [3]

    (20, 0)”, “(0,20)

    Bipartitions and fair coin flips are independent of each other. Therefore, by analyzing from the innermost layer outward, we conclude that the entire composition maintains the unbiased property: Ee[PM,w ] = PM . A.4. Property of XOR operaion We first define our variables. Let x ∈ {0, 1} be our original bit. Let b ∈ {0, 1} be a random bit sampled from Bern...

    work page 2023

  4. [4]

    Let θi = (V i 0, V i 1, ˜δ), and calculate ei t = m[pt] ⊕ bi t

    work page

  5. [5]

    doi: 10.18653/v1/2024.naacl-long.226

    Association for Computational Linguistics. doi: 10.18653/v1/2024.naacl-long.226. Hu, Z., Chen, L., Wu, X., Wu, Y ., Zhang, H., and Huang, H. Unbiased watermark for large language models. In The Twelfth International Conference on Learning Represen- tations, 2024. URL https://openreview.net/f orum?id=uWVC5FVidc. Jovanovi´c, N., Staab, R., and Vechev, M. Wa...

    work page arXiv 2024

  6. [6]

    Sample the next token xt from PM,w = P d M . end for Algorithm 2 Extracting multi-bit message from text Input: a sequence of balanced vocabulary bipartitions [(V 1 0 , V 1 1 ), (V 2 0 , V 2 1 ), ...,(V d 0 , V d 1 )] message length ℓ, window size h pseudorandom functions prfp, prfb

    work page

  7. [7]

    Tang, R., Chuang, Y .-N., and Hu, X

    doi: 10.1038/s41586-024-07566-y. Tang, R., Chuang, Y .-N., and Hu, X. The science of de- tecting llm-generated text. Commun. ACM, 67(4):50–59, March 2024. ISSN 0001-0782. doi: 10.1145/3624725. Team, G. Gemma. Technical report, Gemma Team, 2024a. URL https://www.kaggle.com/m/3301. Team, Q. Qwen2.5: A party of foundation models, Septem- ber 2024b. URL https...

    doi:10.1038/s41586-024-07566-y 2024

  8. [8]

    Wei, J., Zhang, Y ., Yu Zhang, L., Chen, C., Pan, S., Ong, K.-L., Zhang, J., and Xiang, Y

    URL https://openreview.net/forum ?id=JYu5Flqm9D. Wei, J., Zhang, Y ., Yu Zhang, L., Chen, C., Pan, S., Ong, K.-L., Zhang, J., and Xiang, Y . Extracting private training data in federated learning from clients. IEEE Transac- tions on Information Forensics and Security , 20:4525– 4540, 2025. doi: 10.1109/TIFS.2025.3558581. Wu, Y ., Hu, Z., Guo, J., Zhang, H...

    arXiv 2025

Show all 28 references
  1. [9]

    doi: 10.18653/v1/2023.acl-long.117

    Association for Computational Linguistics. doi: 10.18653/v1/2023.acl-long.117. Yoo, K., Ahn, W., and Kwak, N. Advancing beyond iden- tification: Multi-bit watermark for large language mod- els. In Proceedings of the 2024 Conference of the North American Chapter of the Associat...

    2023 doi

  2. [10]

    doi: 10.18653/v1/2024.naacl-long.224

    Association for Computational Linguistics. doi: 10.18653/v1/2024.naacl-long.224. Zhang, H., Wu, B., Wang, S., Yang, X., Xue, M., Pan, S., and Yuan, X. Demystifying uneven vulnerability of link stealing attacks against graph neural networks. In Proceedings of the 40th Internati...

    2024

  3. [13]

    is independent of (V i+1 0 , V i+1 1 )

  4. [16]

    Apply LM to all prior tokens to get a probability distribution PM 0 over the vocabulary

  5. [17]

    If the current previous tokens x−h: in the sliding window have been used as a seed, then sample a next token xt from PM 0; else record the current previous tokens x−h: and apply prfp and prfb to it to get seedp and seedb

  6. [18]

    Sample b1 t , b2 t , · · ·, bd t ∼ Bern(0.5) using seedb

    Sample an index pt ∈ {1, 2, · · ·, ℓ} using seedp. Sample b1 t , b2 t , · · ·, bd t ∼ Bern(0.5) using seedb. for i = 1, 2, · · ·, ddo

  7. [20]

    Obtain the i-layer reweighted distribution P i M = Rθi,ei t (P i−1 M ). end for

  8. [22]

    Initialize a ℓ × 2 voting matrix M for t = 1, 2, · · ·do

  9. [23]

    If the current previous tokens x−h: in a sliding window h have been used as a seed, then skip the current token and continue; else record current previous tokens x−h: and apply it to prfp and prfb to get seedp and seedb

  10. [24]

    Sample b1, b2, · · ·, bd ∼ Bern(0.5) using seedb

    Sample an index p ∈ {1, 2, · · ·, ℓ} using seedp. Sample b1, b2, · · ·, bd ∼ Bern(0.5) using seedb. for i = 1, 2, · · ·d do

  11. [25]

    ˆei t = 1 if xt ∈ Vi 0 else ˆei t = 0

  12. [26]

    end for end for for p from 1 to ℓ do

    update M [pt][loci] += 1. end for end for for p from 1 to ℓ do

  13. [27]

    m[p] = max(M [p][0], [p][1]) end for

  14. [28]

    Examples of Watermarked Text Text Detection Prompt A food processor opens up a world of possibilities, such as hot soups or icy cold concoctions

    Return the extracted message m BiMark: Unbiased Multilayer Watermarking for Large Language Models D. Examples of Watermarked Text Text Detection Prompt A food processor opens up a world of possibilities, such as hot soups or icy cold concoctions. It may be a bit bulky, but pro...

  15. [29]

    11110101111000101001100011000111

    Wooden spoons are going to be your new best friends. Metal tools scratch many pots and pans, but wood won’t cause them any harm. N/A No Watermark Try making banana ice cream with only an immersion blender instead of a traditional ice cream maker and a food processor. It’s a fa...

  16. [2004]

    Gong, Z., Zhang, Y ., Zhang, L

    doi: 10.1117/12.521353. Gong, Z., Zhang, Y ., Zhang, L. Y ., Zhang, Z., Xiang, Y ., and Pan, S. Not all edges are equally robust: Evaluating BiMark: Unbiased Multilayer Watermarking for Large Language Models the robustness of ranking-based federated learning. In 2025 IEEE Symp...

  17. [2020]

    Zhang, X., Zhang, Z., Zhong, Q., Zheng, X., Zhang, Y ., Hu, S., and Zhang, L

    URL https://openreview.net/forum ?id=SkeHuCVFDr. Zhang, X., Zhang, Z., Zhong, Q., Zheng, X., Zhang, Y ., Hu, S., and Zhang, L. Y . Masked language model based textual adversarial example detection. In Proceedings of the 2023 ACM Asia Conference on Computer and Communications S...

    2023 arXiv

  18. [2022]

    Pan, J., Liu, Y ., Zheng, X., Zheng, Y ., Liew, A

    URL https://openai.com/blog/chat gpt. Pan, J., Liu, Y ., Zheng, X., Zheng, Y ., Liew, A. W.-C., Li, F., and Pan, S. A label-free heterophily-guided approach for unsupervised graph fraud detection. Proceedings of the AAAI Conference on Artificial Intelligence, 39(12):12443– 124...

    2025

  19. [2023]

    Fridrich, J., Goljan, M., and Soukal, D

    doi: 10.1109/WIFS58808.2023.10374576. Fridrich, J., Goljan, M., and Soukal, D. Searching for the stego-key. In Security, Steganography, and Watermarking of Multimedia Contents VI , volume 5306, pp. 70 – 82. International Society for Optics and Photonics, SPIE,

    2023

  20. [5445]

    Hou, A., Zhang, J., He, T., Wang, Y ., Chuang, Y .-S., Wang, H., Shen, L., Van Durme, B., Khashabi, D., and Tsvetkov, Y

    Curran Associates, Inc., 2022b. Hou, A., Zhang, J., He, T., Wang, Y ., Chuang, Y .-S., Wang, H., Shen, L., Van Durme, B., Khashabi, D., and Tsvetkov, Y . SemStamp: A semantic watermark with paraphrastic robustness for text generation. In Proceed- ings of the 2024 Conference of...

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.