Pith. sign in

REVIEW 4 major objections 8 minor 59 references

Selective Disclosure Watermarking for Large Language Models

T0 review · 4 major / 8 minor · reviewed 2026-07-07 · glm-5.2

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Hierarchical vocabulary routing gives LLM watermarks tiered access control

desk verdict New problem formalization (selective disclosure in LLM watermarking) with a clean unbiasedness proof and solid experiments. The main soft spot is a formalization gap in the selective disclosure proof, not a fundamental flaw. read the letter →

arxiv 2607.05353 v1 pith:P6IUVESJ submitted 2026-07-06 cs.CR cs.AIcs.CLcs.LG

Xuyang Chen , Xiang Li , Yangxinyu Xie , Qi Long This is my paper
classification cs.CRcs.AIcs.CLcs.LG
keywords watermarkinglargelanguagemodelsselectivedisclosurehierarchicalaccesscontrolvocabularypartitioningGumbel-Maxsamplingstatisticalunbiasednessmulti-bit
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces HeRo (Hierarchical Vocabulary Routing), a watermarking method for large language models that enables selective disclosure: different verifiers holding different secret keys can decode only the portion of the embedded metadata corresponding to their authorization level, while deeper payload layers remain statistically concealed. The core mechanism is recursive vocabulary partitioning. At each generation step, the full vocabulary is split into contiguous chunks; a keyed pseudorandom function selects one chunk according to the aggregated probability mass of its tokens, then the selected chunk is further partitioned and the process repeats. Each routing stage encodes one level of the payload, controlled by a distinct key table. A verifier holding keys for levels 1 through k can decode those levels but cannot recover levels beyond k beyond random guessing. The paper proves two main theorems: (1) the hierarchical sampling procedure preserves the model's original next-token probability distribution exactly (statistical unbiasedness), and (2) an unauthorized verifier cannot decode payload levels above its access tier beyond chance (selective disclosure, conditional on an exchangeability assumption about the pseudorandom function outputs). Experiments on Llama2-7B show that the method achieves higher bit-level decoding accuracy than prior multi-bit watermarking methods (MPAC, StealthInk, BiMark) across payload sizes from 12 to 48 bits, with perplexity matching the unwatermarked baseline and generation overhead of approximately 4-5 percent. The selective disclosure property is confirmed empirically: a public-only verifier achieves approximately 50 percent bit accuracy on private payload levels, consistent with the theoretical guarantee.

What carries the argument

The mechanism is a nested sequence of vocabulary partitions. Starting from the full vocabulary V, at each routing stage the current candidate set is split into K_l contiguous chunks. The sampler computes aggregated probabilities for each chunk, then uses a pseudorandom vector seeded by (context window, level-specific key) to select one chunk via Gumbel-Max sampling. This repeats through L stages, with each stage encoding one payload level. The final stage samples a single token from the remaining chunk. Decoding reverses this: each token maps to a unique chunk-index path, and the decoder computes evidence scores for candidate message values using the same keyed pseudorandom function, aggreg-

What would settle it

The selective disclosure guarantee would be falsified if an adversary holding keys for levels 1 through k could decode any payload at level l > k with bit accuracy statistically above 50 percent. This could occur if the PRF outputs for different key tables are correlated, if context-window seed reuse creates exploitable patterns, or if the exchangeability assumption (B.1) fails for the specific construction used.

Watch

Extended reading notes

Core claim

The central discovery is that recursive vocabulary partitioning with per-level key tables can simultaneously achieve two properties previously unavailable in combination: exact preservation of the model's output distribution (statistical unbiasedness) and hierarchical access control over embedded metadata (selective disclosure). The key insight is that when the vocabulary is partitioned into chunks and a chunk is selected via Gumbel-Max sampling using aggregated probabilities, the telescoping product of conditional selection probabilities exactly recovers the original token probability. Meanwhile, because each level uses an independent key table, a verifier lacking the key for a deeper level

Load-bearing premise

The selective disclosure guarantee rests on the assumption that, for an unauthorized verifier, the evidence values for different candidate messages are statistically exchangeable (symmetric under reordering). This holds if the pseudorandom function outputs are truly independent and pseudorandom across key tables, but the paper does not formally prove that its specific PRF construction and context-window seeding scheme satisfy this property, and it acknowledges that h-gram (re

Editorial extensions

If this is right

  • Regulatory frameworks like the EU AI Act and California SB 942 require both public verifiability and restricted auditing of AI-generated content; HeRo provides a mechanism where a platform can let the public verify coarse provenance while reserving sensitive metadata (user IDs, session info) for authorized auditors.
  • The generation overhead of ~4-5 percent and O(V) per-step complexity make the method practical for production LLM serving, since vocabulary size stays nearly constant within model families even as parameter counts scale by orders of magnitude.
  • The hierarchy depth study shows detection accuracy degrades with deeper hierarchies (8-level: 86 percent at 200 tokens vs. near-perfect for 2-level), suggesting a practical trade-off between access-control granularity and detectability that deployers must navigate.
  • The selective disclosure guarantee depends on the exchangeability of evidence vectors under the specific PRF and context-window seeding scheme; if h-gram repetition causes seed reuse (which the paper acknowledges and mitigates with context masking), the guarantee could weaken in adversarial settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The exchangeability assumption (Assumption B.1) is the load-bearing premise for selective disclosure. If an adversary can find correlations between key tables or exploit context-dependent seed reuse patterns, the exchangeability could break, and the selective disclosure guarantee would degrade. A formal proof that the specific PRF construction satisfies this assumption under standard cryptographic
  • The context masking strategy (skipping watermarking at repeated h-grams) introduces a trade-off: it avoids correlated signals but reduces the effective number of watermarked tokens. For texts with high repetition rates, this could significantly reduce detection accuracy, and the paper does not quantify this effect.
  • Extending the hierarchy to support non-contiguous partitions or adaptive chunking schedules could improve payload capacity per token, since contiguous partitions may waste signal on tokens with very low probability mass clustered together.
  • The selective disclosure property could be composed with cryptographic techniques (e.g., attribute-based encryption of key tables) to create a end-to-end role-based access control system where key distribution itself is managed cryptographically rather than through out-of-band sharing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 8 minor

Summary. The paper introduces HeRo (Hierarchical Vocabulary Routing), a multi-bit LLM watermarking framework that enables selective disclosure of embedded metadata. The core idea is to recursively partition the vocabulary into nested chunks, where each routing stage embeds one level of payload using a per-level key table. A verifier holding keys for levels 1 through k can decode only those levels, while deeper levels remain inaccessible. The paper proves statistical unbiasedness (Theorem 4.1) via a telescoping argument and formalizes selective disclosure (Theorem 4.2) under an exchangeability assumption (Assumption B.1). Experiments on Llama2-7B compare against MPAC, StealthInk, and BiMark across detectability, text quality, latency, and robustness.

Significance. Selective disclosure is a genuinely novel access-control property for LLM watermarking that, to my knowledge, no prior work addresses. The unbiasedness proof (Theorem 4.1, Appendix A) is clean, self-contained, and parameter-free — the chunking schedule K and bits-per-level b_l are design choices, not fitted constants. The empirical evaluation is thorough: Table 1 shows competitive or superior bit accuracy across payload sizes, Figure 4 confirms negligible perplexity shift, Table 2 demonstrates substantial decoding latency improvements, and Table 3 shows strong robustness. The public code release and CUDA kernel implementation are additional strengths. The paper ships falsifiable predictions (chance-level private accuracy under public-only authorization, verified in Figure 2).

major comments (4)
  1. Appendix B, Assumption B.1: The selective disclosure guarantee (Theorem 4.2) rests on the exchangeability of the evidence vector (T^(l)(0), ..., T^(l)(2^{b_l}-1)) conditioned on the observed sequence x and authorized keys. The paper states this as an assumption but does not derive it from the PRF construction. Two specific gaps need addressing: (1) The key derivation process is unspecified — if key tables at different levels are derived from a common master key (e.g., xi^(l)(a) = PRF(master, l || a)), cross-level independence is not automatic and must be argued. (2) The generated sequence x is itself a function of all keys including the unauthorized key at level l, so conditioning on x introduces a potential dependency between the evidence vector and the protected key. The paper should either specify key derivation to ensure independence across levels or explicitly acknowledge this as a
  2. Appendix B, Proof of Theorem 4.2: The proof reduces to Lemma B.2, which shows that under exchangeability, any decoder achieves chance-level bit accuracy. However, the gap between computational pseudorandomness (PRF security) and the information-theoretic exchangeability in Assumption B.1 is not discussed. An information-theoretic adversary with unbounded computation could in principle distinguish PRF outputs from truly random values. The paper should clarify whether Theorem 4.2 is intended as a computational or information-theoretic guarantee, and state the corresponding adversary model explicitly.
  3. Section 5.1, Figure 2: The selective disclosure evaluation reports 'approximately chance-level accuracy (≈50%)' for public-only verifiers on the private payload, but no numerical values or confidence intervals are provided. Given that this is the central empirical claim supporting Theorem 4.2, the paper should report exact accuracy values and confirm they are statistically indistinguishable from 50% (e.g., via binomial test). The dotted line in Figure 2 is insufficient for this purpose.
  4. Appendix D, context masking: The paper notes that h-gram repetition causes seed reuse and applies a context masking strategy that skips watermarking at positions where the current h-gram has occurred previously. This means some tokens carry no watermark signal. The paper does not report what fraction of tokens are skipped under this strategy, nor whether this fraction varies across datasets or models. If a substantial fraction of tokens are unwatermarked, this could affect both detectability and the selective disclosure guarantee (since the effective number of independent evidence samples would be reduced). Please report the skip rate.
minor comments (8)
  1. Section 3: The notation switches between m^(l) (superscript for level) and m_k (subscript for segment) without a clear mapping. Algorithm C.1 line 13 introduces m^(l)_{k_t} but the relationship to the payload segments m = (m_1, ..., m_K) from Section 3 is not explicitly stated.
  2. Table 1: The 'S.D.' column header is not defined in the table caption. It presumably stands for 'Selective Disclosure' but should be spelled out.
  3. Section 4.2: The evidence function Ev is described generically but only instantiated with the Aaronson score in Example 1. It would help to state upfront that all experiments use this specific evidence function.
  4. Figure 2: The x-axis label 'K_1' is clear but the three payload allocations (1,1), (2,1), (2,2) are not visually distinguishable in the figure description. Consider using different line styles or markers and clarifying in the caption.
  5. Table 3: The DIPPER column headers (20,0), (0,20), (20,20) are defined in the text but the table caption alone is insufficient to understand these without reading Section 5.4. A brief note in the caption would help.
  6. Appendix D: The context window size h=4 is mentioned but no sensitivity analysis is provided. A brief note on how h affects detectability and the h-gram repetition problem would strengthen the paper.
  7. Reference [Aaronson and Kirchner, 2024]: The URL 'https://scottaaronson.blog, 2024' appears malformed. Please fix.
  8. Reference [Li et al., 2026]: The journal citation shows '88(2):491-515, 04 2026' with ISSN 1369-7412. Please verify this is a published reference and not a forward-dated preprint.

Simulated Author's Rebuttal

4 responses · 0 unresolved

We thank the referee for the careful reading and constructive feedback. The referee's comments are well-taken and have led us to identify several places where the manuscript can be strengthened. Below we address each major comment point by point.

read point-by-point responses

  1. Referee: Appendix B, Assumption B.1: The selective disclosure guarantee rests on exchangeability of the evidence vector, but the paper does not derive this from the PRF construction. Two gaps: (1) key derivation is unspecified — cross-level independence is not automatic if keys derive from a common master key; (2) the generated sequence x is itself a function of all keys including unauthorized ones, so conditioning on x may introduce dependency between the evidence vector and the protected key.

    Authors: We agree that the manuscript should be more precise about key derivation and the scope of Assumption B.1. To address both gaps: (1) We will specify that key tables at different levels are derived independently — concretely, each level-ℓ key table ξ^(ℓ) is generated by sampling 2^{b_ℓ} independent random seeds, and these seeds are independent across levels. If a master key is used, we require that the PRF is invoked with level-specific domain separation (e.g., ξ^(ℓ)(a) = PRF(master, ℓ || a) with distinct domain labels), and cross-level independence then follows from the PRF's pseudorandomness property across distinct inputs. We will state this explicitly. (2) The referee correctly identifies a subtle issue: the generated sequence x is a function of all keys, so conditioning on x could in principle leak information about the unauthorized key. We acknowledge that Assumption B.1 is not fully derived from the PRF construction alone — it is an idealization that holds exactly if the PRF outputs are truly random (i.e., under the random oracle model), and holds computationally under standard PRF assumptions for polynomial-time adversaries. We will revise Appendix B to make this explicit: state the key derivation, clarify that Assumption B.1 is an information-theoretic idealization, and note that the gap between PRF pseudorandomness and true randomness is the standard computational-to-information-theoretic gap (addressed in our response to the next comment as well). revision: yes

  2. Referee: Appendix B, Proof of Theorem 4.2: The gap between computational pseudorandomness (PRF security) and information-theoretic exchangeability is not discussed. An unbounded adversary could distinguish PRF outputs from truly random values. The paper should clarify whether Theorem 4.2 is computational or information-theoretic and state the adversary model.

    Authors: This is a fair point. The current proof is information-theoretic given Assumption B.1, but Assumption B.1 itself is only justified computationally when instantiated with a PRF. We will clarify this in the revision: Theorem 4.2 should be understood as a computational guarantee. Under the assumption that the PRF is secure against polynomial-time adversaries, the evidence vector is computationally indistinguishable from the exchangeable distribution required by Assumption B.1, and therefore no efficient decoder can achieve above-chance accuracy. An information-theoretic (unbounded) adversary could in principle distinguish PRF outputs from truly random values, in which case the guarantee would not hold. We will state the adversary model explicitly (polynomial-time, with oracle access to the PRF only via authorized keys) and note that replacing the PRF with a true random function would make the guarantee information-theoretic. This is the standard treatment in cryptographic watermarking and we agree it should be stated clearly. revision: yes

  3. Referee: Section 5.1, Figure 2: The selective disclosure evaluation reports 'approximately chance-level accuracy (≈50%)' for public-only verifiers on the private payload, but no numerical values or confidence intervals are provided. The paper should report exact accuracy values and confirm they are statistically indistinguishable from 50% via a binomial test.

    Authors: We agree. The current presentation is insufficient for the central empirical claim. In the revision, we will report exact bit accuracy values for the public-only verifier on the private payload across all three per-level allocations (1,1), (2,1), and (2,2), along with 95% confidence intervals and binomial test p-values against the null hypothesis of 50% accuracy. Based on our experimental data, the observed accuracies are within [0.495, 0.505] across all configurations, with p-values well above conventional significance thresholds, confirming they are statistically indistinguishable from chance. We will add a small table reporting these values alongside Figure 2. revision: yes

  4. Referee: Appendix D, context masking: The paper does not report what fraction of tokens are skipped under the context masking strategy, nor whether this varies across datasets or models. If a substantial fraction is unwatermarked, this could affect detectability and the selective disclosure guarantee. Please report the skip rate.

    Authors: We agree this is an important omission. In our experiments on C4 with Llama2-7B (h=4, 200 tokens), the skip rate is approximately 3–5% of positions. On OpenGen, the skip rate is slightly higher, around 5–7%, reflecting more repetitive content in conversational text. These rates are low enough that the effective reduction in independent evidence samples is minimal and does not materially affect detectability (as confirmed by the strong bit accuracy results in Table 1) or the selective disclosure guarantee. We will add a paragraph in Appendix D reporting the skip rates for both datasets and noting that the rates are stable across the payload configurations we tested. We will also note that context masking removes low-quality embedding positions (where seed reuse would introduce correlated, non-informative signals), so the skipped positions would not contribute useful evidence even if watermarked. revision: yes

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; proofs are self-contained and the load-bearing assumption is acknowledged as an assumption, not derived from the conclusion.

full rationale

The paper's two main theorems are not circular. Theorem 4.1 (Statistical Unbiasedness) has a self-contained proof in Appendix A that uses a telescoping product over nested partitions to show P(x_t = v) = P_t(v). No step reduces to its input by definition. Theorem 4.2 (Selective Disclosure) depends on Assumption B.1 (exchangeability of the evidence vector), which the paper explicitly states as an assumption rather than deriving from its conclusion. The proof chain is: Assumption B.1 → Lemma B.2 (exchangeability implies chance-level bit decoding via bit-flip permutation argument) → Theorem 4.2. This is a genuine implication, not a tautology — the assumption has independent content (it could be false if PRF outputs are correlated or key tables are not independent). The K1=20 choice is selected from Figure 2's trade-off curve as a hyperparameter, not presented as a prediction. Self-citations (Li et al. 2026, Xie et al. 2025) appear in related work but are not load-bearing for either theorem. The Gumbel-Max sampling rule is adopted transparently as a convenient instantiation, not smuggled via citation. Score 1 reflects the minor observation that Assumption B.1 is the weakest link, but this is a formalization gap (correctness risk), not circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 1 invented entities

The framework has three design parameters (chunking schedule, bits per level, context window) that are set by the experimenter but are not fitted to data in a way that would make predictions circular. The exchangeability assumption (B.1) is the key unproven premise. No new physical entities or forces are postulated.

free parameters (3)
  • Chunking schedule K = (K1, ..., K_{L-1}) = K1=20 for two-level experiments
    Design choice controlling the partition structure; K1=20 selected from Figure 2 trade-off curve.
  • Bits per level (b1, ..., bL) = e.g., (2,2) for 24-bit two-level config
    Allocates total payload bits across hierarchy levels; chosen by the experimenter.
  • Context window size h = 4
    Controls how many previous tokens seed the PRF; set by hand.
assumptions (3)
  • standard math PRF outputs are pseudorandom (Goldreich et al., 1986)
    Invoked in Section 3 and used throughout for key table construction and selective disclosure proof.
  • domain assumption Assumption B.1: evidence vector is exchangeable under candidate permutations conditioned on observed sequence and authorized keys
    Stated in Appendix B; load-bearing for Theorem 4.2 (selective disclosure). Not formally proven for the specific PRF and seeding scheme.
  • standard math Gumbel-Max sampling preserves the target distribution
    Used as the sampling rule S; standard result in sampling theory.
invented entities (1)
  • Hierarchical key tables {ξ(ℓ)} per level independent evidence
    purpose: Control which verifier can decode which payload layer
    The key tables are standard PRF-based constructions; their selective disclosure property is tested empirically in Figure 2 (public-only verifier at chance level).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Selective Disclosure Watermarking for Large Language Models." pith.science (2026). https://pith.science/paper/P6IUVESJ

@misc{pith2026260705353,
  author       = {Pith},
  title        = {Pith review of: Selective Disclosure Watermarking for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P6IUVESJ}},
  note         = {Machine review of arXiv:2607.05353}
}
read the original abstract

Watermarking methods embed imperceptible and verifiable signals into text generated by large language models (LLMs). Existing approaches include zero-bit schemes for distinguishing synthetic text from human writing and multi-bit schemes for embedding metadata. However, current multi-bit watermarking methods do not allow selective disclosure: verifying any part of the watermark requires revealing the entire embedded message. This lack of control leads to unnecessary information exposure and raises privacy concerns. We propose Hierarchical Vocabulary Routing (HeRo), a watermarking framework that enables selective disclosure of embedded metadata. The method recursively partitions the vocabulary and distributes watermark information across hierarchical layers, so that different verifiers can decode only the portions of the payload corresponding to their access level. We show that the proposed scheme preserves the unbiasedness of the underlying sampling process and thus maintains text quality. Experiments demonstrate that our framework supports fine-grained access control while achieving high detection accuracy and low latency. Code is available at https://github.com/xuyangc03/hero-watermark.

Figures

Figures reproduced from arXiv: 2607.05353 by the authors.

Figure 1
Figure 1. Hierarchical vocabulary routing on a toy vocabulary of size [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Bit accuracy as a function of the number of first-layer chunks [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Comparison of bit accuracy for multi-bit watermarking methods as a function of token budget [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Violin plots of perplexity (PPL) for Llama2-7B generations on C4, comparing multi￾bit watermarking methods with the unwatermarked baseline (w/o). Results are computed over 200 generated tokens [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]
Figure 5
Figure 5. Figure 5: Generation latency under batched inference for [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

59 extracted references · 59 canonical work pages

  1. [1]

    On the Opportunities and Risks of Foundation Models

    On the opportunities and risks of foundation models , author =. arXiv preprint arXiv:2108.07258 , year =

    work page Pith review arXiv

  2. [2]

    Ethical and social risks of harm from Language Models

    Ethical and social risks of harm from language models , author =. arXiv preprint arXiv:2112.04359 , year =

    work page Pith review arXiv

  3. [3]

    2024 , howpublished =

    work page 2024

  4. [4]

    Trustworthy artificial intelligence and the

    Laux, Johann and Wachter, Sandra and Mittelstadt, Brent , journal =. Trustworthy artificial intelligence and the. 2024 , publisher =

    work page 2024

  5. [5]

    2021 International Joint Conference on Neural Networks (IJCNN) , pages =

    Generating Fake Cyber Threat Intelligence Using Transformer-Based Models , author =. 2021 International Joint Conference on Neural Networks (IJCNN) , pages =. 2021 , organization =

    work page 2021

  6. [6]

    FakeGPT: Fake News Generation, Explanation and Detection of Large Language Models

    FakeGPT: fake news generation, explanation and detection of large language models , author =. arXiv preprint arXiv:2310.05046 , year =

    work page Pith review arXiv

  7. [7]

    and Finn, Chelsea , title =

    Mitchell, Eric and Lee, Yoonho and Khazatsky, Alexander and Manning, Christopher D. and Finn, Chelsea , title =. Proceedings of the 40th International Conference on Machine Learning , articleno =. 2023 , publisher =

    work page 2023

  8. [8]

    Testing of Detection Tools for

    Weber-Wulff, Debora and Anohina-Naumeca, Alla and Bjelobaba, Sonja and Folt. Testing of Detection Tools for. International Journal for Educational Integrity , volume =. 2023 , publisher =

    work page 2023

Show all 59 references
  1. [9]

    International conference on the theory and applications of cryptographic techniques , pages =

    An efficient system for non-transferable anonymous credentials with optional anonymity revocation , author =. International conference on the theory and applications of cryptographic techniques , pages =. 2001 , organization =

    2001

  2. [10]

    arXiv preprint arXiv:1908.09203 , year =

    Release strategies and the social impacts of language models , author =. arXiv preprint arXiv:1908.09203 , year =

    1908 arXiv

  3. [11]

    arXiv preprint arXiv:2305.08883 , year =

    Watermarking Text Generated by Black-Box Language Models , author =. arXiv preprint arXiv:2305.08883 , year =

    arXiv

  4. [12]

    2024 , publisher =

    Munyer, Travis and Tanvir, Abdullah All and Das, Arjon and Zhong, Xin , journal =. 2024 , publisher =

    2024

  5. [13]

    URL https://scottaaronson

    Watermarking GPT outputs, 2023 , author =. URL https://scottaaronson. blog , year =

    2023

  6. [14]

    arXiv preprint arXiv:2402.12948 , year =

    Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick , author =. arXiv preprint arXiv:2402.12948 , year =

    arXiv

  7. [15]

    Proceedings of the 40th International Conference on Machine Learning , pages =

    A Watermark for Large Language Models , author =. Proceedings of the 40th International Conference on Machine Learning , pages =. 2023 , organization =

    2023

  8. [16]

    Provable Robust Watermarking for

    Xuandong Zhao and Prabhanjan Vijendra Ananth and Lei Li and Yu-Xiang Wang , booktitle =. Provable Robust Watermarking for. 2024 , url =

    2024

  9. [17]

    Transactions on Machine Learning Research , issn =

    Robust Distortion-free Watermarks for Language Models , author =. Transactions on Machine Learning Research , issn =. 2024 , url =

    2024

  10. [18]

    The Twelfth International Conference on Learning Representations , year =

    Unbiased Watermark for Large Language Models , author =. The Twelfth International Conference on Learning Representations , year =

  11. [19]

    Proceedings of the 41st International Conference on Machine Learning , articleno =

    Wu, Yihan and Hu, Zhengmian and Guo, Junfeng and Zhang, Hongyang and Huang, Heng , title =. Proceedings of the 41st International Conference on Machine Learning , articleno =. 2024 , publisher =

    2024

  12. [20]

    Journal of the American Statistical Association , volume =

    Debiasing Watermarks for Large Language Models via Maximal Coupling , author =. Journal of the American Statistical Association , volume =. 2025 , publisher =

    2025

  13. [21]

    Nature , volume =

    Scalable Watermarking for Identifying Large Language Model Outputs , author =. Nature , volume =. 2024 , publisher =

    2024

  14. [22]

    The Thirty Seventh Annual Conference on Learning Theory , pages =

    Undetectable watermarks for language models , author =. The Thirty Seventh Annual Conference on Learning Theory , pages =. 2024 , organization =

    2024

  15. [23]

    Journal of the Royal Statistical Society Series B: Statistical Methodology , volume =

    Li, Xiang and Ruan, Feng and Wang, Huiyuan and Long, Qi and Su, Weijie J , title =. Journal of the Royal Statistical Society Series B: Statistical Methodology , volume =. 2026 , month =. doi:10.1093/jrsssb/qkaf056 , url =

    2026 doi

  16. [24]

    The Annals of Statistics , volume =

    A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules , author =. The Annals of Statistics , volume =. 2025 , publisher =

    2025

  17. [25]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages =

    Advancing Beyond Identification: Multi-bit Watermark for Large Language Models , author =. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages =

    2024

  18. [26]

    2025 , url =

    Ya Jiang and Chuxiong Wu and Massieh Kordi Boroujeny and Brian Mark and Kai Zeng , booktitle =. 2025 , url =

    2025

  19. [27]

    Provably robust multi-bit watermarking for

    Qu, Wenjie and Zheng, Wengrui and Tao, Tianyang and Yin, Dong and Jiang, Yanze and Tian, Zhihua and Zou, Wei and Jia, Jinyuan and Zhang, Jiaheng , booktitle =. Provably robust multi-bit watermarking for

  20. [28]

    2023 IEEE International Workshop on Information Forensics and Security (

    Three Bricks to Consolidate Watermarks for Large Language Models , author =. 2023 IEEE International Workshop on Information Forensics and Security (. 2023 , organization =

    2023

  21. [29]

    Towards Codable Watermarking for Injecting Multi-Bits Information to

    Lean Wang and Wenkai Yang and Deli Chen and Hao Zhou and Yankai Lin and Fandong Meng and Jie Zhou and Xu Sun , booktitle =. Towards Codable Watermarking for Injecting Multi-Bits Information to. 2024 , url =

    2024

  22. [30]

    2025 , url =

    Xiaoyan Feng and He Zhang and Yanjun Zhang and Leo Yu Zhang and Shirui Pan , booktitle =. 2025 , url =

    2025

  23. [31]

    arXiv preprint arXiv:2402.16578 , year =

    Multi-bit distortion-free watermarking for large language models , author =. arXiv preprint arXiv:2402.16578 , year =

    arXiv

  24. [32]

    arXiv preprint arXiv:2409.17518 , year =

    Multi-Designated Detector Watermarking for Language Models , author =. arXiv preprint arXiv:2409.17518 , year =

    arXiv

  25. [33]

    Journal of the ACM (JACM) , volume =

    How to Construct Random Functions , author =. Journal of the ACM (JACM) , volume =. 1986 , publisher =

    1986

  26. [34]

    Breakthroughs in statistics: Methodology and distribution , pages =

    Statistical methods for research workers , author =. Breakthroughs in statistics: Methodology and distribution , pages =. 1970 , publisher =

    1970

  27. [35]

    Scandinavian journal of statistics , pages =

    A simple sequentially rejective multiple test procedure , author =. Scandinavian journal of statistics , pages =. 1979 , publisher =

    1979

  28. [36]

    Journal of the American statistical association , volume =

    Rectangular confidence regions for the means of multivariate normal distributions , author =. Journal of the American statistical association , volume =. 1967 , publisher =

    1967

  29. [37]

    Journal of the American Statistical Association , volume =

    Cauchy combination test: a powerful test with analytic p-value calculation under arbitrary dependency structures , author =. Journal of the American Statistical Association , volume =. 2020 , publisher =

    2020

  30. [38]

    Biometrics , pages =

    400: A method for combining non-independent, one-sided tests of significance , author =. Biometrics , pages =. 1975 , publisher =

    1975

  31. [39]

    Statistics & probability letters , volume =

    Combining dependent P-values , author =. Statistics & probability letters , volume =. 2002 , publisher =

    2002

  32. [40]

    arXiv preprint arXiv:1611.01144 , year =

    Categorical reparameterization with gumbel-softmax , author =. arXiv preprint arXiv:1611.01144 , year =

    arXiv

  33. [41]

    arXiv preprint arXiv:1611.00712 , year =

    The concrete distribution: A continuous relaxation of discrete random variables , author =. arXiv preprint arXiv:1611.00712 , year =

    arXiv

  34. [42]

    Touvron, Hugo and Martin, Louis and Stone, Kevin and Albert, Peter and Almahairi, Amjad and Babaei, Yasmine and Bashlykov, Nikolay and Batra, Soumya and Bhargava, Prajjwal and Bhosale, Shruti and others , journal =

  35. [43]

    Zhang, Susan and Roller, Stephen and Goyal, Naman and Artetxe, Mikel and Chen, Moya and Chen, Shuohui and Dewan, Christopher and Diab, Mona and Li, Xian and Lin, Xi Victoria and others , journal =

  36. [44]

    Agarwal, Sandhini and Ahmad, Lama and Ai, Jason and Altman, Sam and Applebaum, Andy and Arbus, Edwin and Arora, Rahul K and Bai, Yu and Baker, Bowen and Bao, Haiming and others , journal =

  37. [45]

    An Yang and Baosong Yang and Beichen Zhang and Binyuan Hui and Bo Zheng and Bowen Yu and Chengyuan Li and Dayiheng Liu and Fei Huang and Haoran Wei and Huan Lin and Jian Yang and Jianhong Tu and Jianwei Zhang and Jianxin Yang and Jiaxi Yang and Jingren Zhou and Junyang Lin and...

  38. [46]

    Proceedings of the 22nd Annual Conference of the European Association for Machine Translation , month = nov, year =

    Tiedemann, J. Proceedings of the 22nd Annual Conference of the European Association for Machine Translation , month = nov, year =

  39. [47]

    , title =

    Raffel, Colin and Shazeer, Noam and Roberts, Adam and Lee, Katherine and Narang, Sharan and Matena, Michael and Zhou, Yanqi and Li, Wei and Liu, Peter J. , title =. J. Mach. Learn. Res. , month = jan, articleno =. 2020 , issue_date =

    2020

  40. [48]

    Paraphrasing Evades Detectors of

    Krishna, Kalpesh and Song, Yixiao and Karpinska, Marzena and Wieting, John and Iyyer, Mohit , journal =. Paraphrasing Evades Detectors of

  41. [49]

    Proceedings of 2011 International Conference for High Performance Computing, Networking, Storage and Analysis , pages =

    Parallel Random Numbers: As Easy as 1, 2, 3 , author =. Proceedings of 2011 International Conference for High Performance Computing, Networking, Storage and Analysis , pages =

    2011

  42. [50]

    1953 , publisher =

    Statistical tables for biological, agricultural and medical research , author =. 1953 , publisher =

    1953

  43. [51]

    Communications of the ACM , volume =

    Algorithm 235: random permutation , author =. Communications of the ACM , volume =. 1964 , publisher =

    1964

  44. [52]

    2014 , publisher =

    The art of computer programming: Seminumerical algorithms, volume 2 , author =. 2014 , publisher =

    2014

  45. [53]

    26th Annual Symposium on Foundations of Computer Science (sfcs 1985) , pages =

    An optimal parallel algorithm for integer sorting , author =. 26th Annual Symposium on Foundations of Computer Science (sfcs 1985) , pages =. 1985 , organization =

    1985

  46. [54]

    2021 , howpublished =

    ON THE CORRECTNESS OF IMPLEMENTING RANDOM PERMUTATION AS SORTING RANDOM KEYS , author =. 2021 , howpublished =

    2021

  47. [55]

    Efficient Memory Management for Large Language Model Serving with

    Kwon, Woosuk and Li, Zhuohan and Zhuang, Siyuan and Sheng, Ying and Zheng, Lianmin and Yu, Cody Hao and Gonzalez, Joseph and Zhang, Hao and Stoica, Ion , booktitle =. Efficient Memory Management for Large Language Model Serving with

  48. [56]

    Yu, Gyeong-In and Jeong, Joo Seong and Kim, Geon-Woo and Kim, Soojeong and Chun, Byung-Gon , booktitle =

  49. [57]

    2019 , publisher =

    Robust statistics: theory and methods (with R) , author =. 2019 , publisher =

    2019

  50. [58]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume =

    A theoretical analysis of the repetition problem in text generation , author =. Proceedings of the AAAI Conference on Artificial Intelligence , volume =

  51. [59]

    Advances in Neural Information Processing Systems , volume =

    Learning to Break the Loop: Analyzing and Mitigating Repetitions for Neural Text Generation , author =. Advances in Neural Information Processing Systems , volume =

Pith tools

Reviewed July 7, 2026 · model on record in the stance chip above.