Multi-use LLM Watermarking and the False Detection Problem

Chris Russell; Zihao Fu

REVIEW 3 major objections 5 minor 17 references

Multi-use LLM Watermarking and the False Detection Problem

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that watermarking schemes that reuse the same statistics for detecting AI-generated text and identifying the user become systematically worse at avoiding false positives as the supported user count grows, and that…

desk verdict A real, previously under-stated failure mode with a clean fix, but the strong constant-FNR claim needs proof or a matched-operating-point experiment. read the letter →

arxiv 2506.15975 v1 pith:WU2AKPPI submitted 2025-06-19 cs.CR cs.CL

Zihao Fu , Chris Russell This is my paper · ORCID

classification cs.CRcs.CL

keywords LLMwatermarkingfalsedetectionproblemdualwatermarkidentificationpositiverateGumbel-Maxtrickkeycapacitytextprovenance

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper targets a reliability failure in LLM watermarking: when one scheme both detects machine-generated text and identifies which user's key generated it, the detection decision is made by taking the maximum score over all candidate keys. The authors prove that as the number of keys $K$ grows, unwatermarked text is increasingly likely to clear the detection threshold; their bound is $\Pr(\max_{\xi} S_k(\xi) \ge \tau_k) \le 1 - (1 - \exp(T(\tau_k(1/e - 1) + 1)))^K$, which rises with $K$. They attribute this to reusing the identification statistic for detection, and propose Dual Watermark (DW), which saves a separate set of tokens purely for detection, and Hybrid Dual Watermark (HDW), which uses both signals. On distribution-based and dictionary-based backbones, the proposed schemes keep detection accuracy while cutting the false positive ratio substantially, matching the theoretical bounds. A reader should care because false positives accuse humans of being machines, and the failure only gets worse as a service scales to more users.

What carries the argument

The object that carries the argument is the score statistic $S_k(\xi) = -\frac{1}{T}\sum_i \ln(1 - u_{i,x_i}(\xi))$, computed from uniform random variables recovered by hashing preceding tokens together with a candidate key; for unwatermarked text each term is exponential with rate 1, so $S_k$ is Gamma$(T, 1/T)$, and taking the maximum over $K$ keys inflates the tail. The proposed machinery is a hash-based decision function $d_i$ that deterministically labels each token as either a detection token or an identification token, so the detection score $S_d$ and the key scores $S_k(\xi)$ are built from disjoint token sets; the Gumbel-Max equivalence of the underlying sampler justifies treating the recovered variables as independent uniform draws under the null. The key work of this machinery is to decouple the maximum over keys from the detection decision, which is what makes the false-positive bound independent of $K$.

What would settle it

Take a corpus of human-written text, run the FKE detector with $K=1$ and $K=2000$ at a threshold fixed by a chosen false-negative rate, and measure the false-positive rate on the corpus; if the FPR does not rise with $K$, the theorem's mechanism is not operating, and the same experiment with a hash family known to produce correlated scores across keys would test whether the random-oracle assumption is load-bearing.

Watch

Extended reading notes

Core claim

The central claim is that Full Key Encoding (FKE)—the standard way of combining detection and identification, where every token encodes the key and the maximum key score is thresholded—has a false-positive probability that grows with key capacity $K$. Concretely, the paper proves $$\Pr\left(\max_{\xi} S_k(\xi) \ge \tau_k\right) \le 1 - \left(1 - \exp\left(T\left(\tau_k\left(\frac{1}{e}-1\right)+1\right)\right)\right)^{K},$$ so for fixed text length $T$ and threshold $\tau_k$, the false-alarm risk rises as $K$ grows; the same qualitative failure appears in dictionary-based multi-bit watermarking, where the maximum over blocks turns a binomial statistic into a Gumbel one. The proposed Dual Watermark instead allocates a fraction $r_d$ of tokens to a detection-only score and the rest to key identification, making the false-positive bound independent of $K$, while Hybrid Dual Watermark additionally requires the key-score maximum to clear a threshold, giving a bound that dominates FKE for $K > 1$. Experiments across 20 to 2000 keys show FKE's false positive ratio rising with $K$ while HDW stays roughly flat.

Load-bearing premise

The bounds assume the hash function behaves like a random oracle, so that for unwatermarked text the recovered scores are independent uniform random variables across every candidate key and across the two token partitions; if real hashes introduce correlations, the $K$-growth of FKE's false positives and the $K$-independence of DW could both be weaker than claimed.

Editorial extensions

If this is right

At a fixed detection threshold, the false-positive probability for full-key encoding grows with the supported user count, so a service that scales users without redesigning its watermark will see more human-written text flagged as machine-generated.
Dual Watermark's false-positive bound does not depend on $K$, so detection reliability can stay stable as the user base grows, at the cost of a slight drop in identification accuracy because fewer tokens carry the key.
Hybrid Dual Watermark dominates full-key encoding whenever $K > 1$ and coincides with it when $K = 1$, giving a strict improvement in the false-positive regime with no loss of identification accuracy in the comparison setting.
Dictionary-based multi-bit watermarking also exhibits the false-detection problem: the max over blocks shifts the statistic toward a Gumbel distribution, so its false-positive rate grows with message length; applying the dual-token split restores stability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Theorems 1-3 bound a fixed-threshold false-positive rate; the paper's motivating 'constant false-negative ratio' claim would require extending the analysis to thresholds that adapt during tuning, which the appendix shows depends on the fraction of watermarked text in the dataset.
The same decoupling principle—never let a maximum over a growing candidate set feed a detection decision—likely applies beyond watermarks to plagiarism screening, biometric matching, and other forensic tasks where 'is this signal present?' is answered by searching a large database.
A natural next step, not explored in the paper, is to make $r_d$, the detection-token fraction, adapt to text length and key capacity; the appendix's numerical bound (DW wins for $K$ above roughly 15-115 depending on $r_d$ and $T$) suggests a simple rule for when the dual split pays off.
Tests with concrete hash families would map how much slack the random-oracle assumption provides: if real hashes introduce correlations across keys, the $K$-growth of FKE's false positives and the $K$-independence of DW could both be weaker than the bounds claim.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Zihao and Chris have a real observation: if the same score is used both to detect watermarks and to identify which user key produced them, the max-over-K operation inflates the false positive rate as the number of users grows. That is true, and it has not been clearly stated in the watermarking literature. The fix, reserving separate token pools for detection and identification, is simple and plausible, and the key-capacity experiment (Table 2) shows FKE's FPR rising with K while HDW's stays roughly flat. The theory is elementary but correct under the random-oracle hash assumption: null scores are Gamma, so the maximum over K keys shifts upward. The paper is honest about its setup and gives useful bounds, even though the bounds are loose Chernoff tails. Where I part company is the constant-FNR claim. The introduction says the false detection problem manifests 'provided the False Negative Ratio is held constant.' The theorems do not establish that. Theorem 1 fixes the threshold and shows the FPR bound grows with K. That is a different statement. To keep FNR fixed, the threshold would have to move with K, and the paper never analyzes that offset. The experiments do not fill the gap either: thresholds are selected to maximize accuracy on a dev set, not to match FNR across methods. So the reported FPR advantage of DW/HDW over FKE could partly be a threshold artifact. I do not think the central idea is wrong; the key-capacity trend is visible even without matched FNR, but the strong claim needs either a proof or a matched-operating-point experiment. Two smaller issues. First, the empirical section does not release code or data, which hurts reproducibility. Second, the PKE baseline is underpowered because it throws away half the tokens, so the DW-vs-PKE comparison does not isolate the effect of avoiding the max operation. The paper should also acknowledge that the random-oracle assumption is an idealization; a non-uniform hash could weaken the bounds. Bottom line: this is a useful, honest paper that pinpoints a real failure mode and offers a plausible remedy. It deserves peer review, with the expectation that the authors tighten the constant-FNR claim and add a matched-FNR comparison. Researchers working on multi-user LLM watermarking should read it, and I would cite it for the false detection problem.

Referee Report

3 major / 5 minor

Summary. The paper studies LLM watermarking schemes that simultaneously support detection (is this text machine-generated?) and identification (which user/key generated it?). It identifies a 'false detection problem': when the same per-token scores are reused both to embed a user key and to decide whether text is watermarked (termed Full Key Encoding, FKE), the maximum over K candidate keys makes unwatermarked text increasingly likely to exceed a fixed detection threshold as K grows. The paper formalizes this via Chernoff-style false-positive bounds (Theorems 1–3), proposes Dual Watermarking (DW) and Hybrid Dual Watermarking (HDW), which allocate separate token subsets to detection and identification statistics, and reports experiments on Guanaco-7b/Alpaca with both distribution-based and dictionary-based backbones showing lower FPR and comparable accuracy for DW/HDW relative to FKE.

Significance. If the central claim holds, this is a practically important observation for multi-user LLM watermarking: a naive combination of detection and identification can degrade detection reliability as the user base grows, and a simple token-splitting fix can mitigate it. The theoretical analysis is largely parameter-free, built on standard exponential/Gamma facts and a random-oracle view of the hash function, and the experiments include a dev/test split, key-capacity scaling, robustness attacks, and domain-specific datasets. The main gap is that the paper's headline claim about behavior 'at constant FNR' is not actually established: Theorems 1–3 bound FPR at fixed thresholds, and the experiments tune thresholds to maximize accuracy rather than to hold FNR fixed. The contribution is therefore plausible and likely correct in spirit, but the current manuscript overstates what is proven and what the experiments demonstrate.

major comments (3)

[Section 1 and Section 4.1, Theorem 1] The motivating claim is that FKE's false positive rate grows with key capacity 'provided the False Negative Ratio is held constant,' but Theorem 1 bounds the false positive probability only for a fixed threshold tau_k. No theorem or corollary analyzes how tau_k must move with K to keep FNR constant, nor proves that the FPR growth survives at matched FNR. (A short argument would help: for watermarked text the statistic is the maximum over the correct key and K-1 wrong keys, so a threshold calibrated at K=1 gives a constant FNR bound for all K; the paper should state this explicitly and then verify that the FPR growth at that fixed threshold is the relevant comparison.) As written, the theory does not support the phrase 'at any FNR' used in the introduction and in Section 4.1.
[Figure 1, Table 4, Section A.9] The comparison between FKE and DW/HDW is made by plotting or tabulating the Chernoff upper bounds at the same numerical threshold (tau=1.6). Upper bounds that are very loose in the displayed regime (e.g., the DW bound is around 0.33 at T=100 while the true Gamma tail is negligible) do not establish that DW's actual FPR is lower than FKE's at equal FNR. The plots demonstrate dominance of one bound over another, not dominance of the actual false positive rates under matched operating points. The paper should either derive a comparison at matched FNR or add experiments that calibrate thresholds on watermarked text to a target FNR and then measure FPR on unwatermarked text.
[Section 5.2, Table 2] The key-capacity experiment does not state whether the same thresholds are used across all K or whether thresholds are retuned per K (or per watermark ratio, as described in Appendix A.10). If thresholds are retuned to maximize Accu-I at each K, the observed FPR increase for FKE (0.178 at K=20 to 0.295 at K=2000) could be partly a threshold-artifact rather than the K-dependent phenomenon of Theorem 1. The authors should report the threshold-setting procedure and, ideally, show FPR as a function of K with fixed thresholds and with thresholds calibrated to a constant FNR. Without this, the empirical claim that DW/HDW outperform FKE 'at any FNR' is not directly supported.

minor comments (5)

[Throughout] There are numerous typos and inconsistent labels: 'a analysis' (Conclusion), 'origional' and 'walues' (Appendix A.8 and Figure 2 caption), 'DWI' vs 'DW' in tables and figures, and 'Multibit' as both 'Multi-bit' and 'Multibit'. A careful proofread is needed.
[Figures 14 and 15] The y-axis labels in Figures 14 and 15 say 'FPR' but the plotted values (roughly 0.75–0.98) look like accuracy values; the captions say 'scores' without specifying the metric. Please fix the labels or the captions.
[Section 5] The paper repeatedly invokes FNR as the quantity held constant in the motivating claim, but FNR is never reported in any experiment. Given the central role of the matched-FNR claim, reporting FNR (or the accuracy on watermarked-only subsets) would substantially clarify the empirical picture.
[Section 3.3] The statement that the hash-based encoding is 'naturally robust to deletion or insertion' is too strong, since changing surrounding tokens changes subsequent hash keys; the insertion/deletion experiments actually show degradation. Please soften the claim or qualify it as robustness to small local edits.
[Section 4.1, Theorem 3] The independence between S_d and max_xi S_k(xi) used in the proof is asserted without explicitly stating the conditioning on the observed token sequence (which fixes the indicator values d_i). For unwatermarked text this independence follows from the random-oracle assumption, but the theorem statement should state the assumption that the token subsets are fixed or condition on d_i.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the theoretical bounds are derived from standard uniform/Gamma facts, and the experimental advantage is evaluated on held-out data; the fixed-FNR claim is a support gap, not a circular reduction.

full rationale

The paper's central derivation chain is self-contained. Theorem 1 bounds Pr(max_xi S_k(xi) >= tau_k) for unwatermarked text by first showing each S_k(xi) is Gamma(T, 1/T) under the uniform null (Lemmas 1-2) and then applying a Chernoff tail bound (Lemma 3) and a union/independence bound over K keys (Lemma 4). Theorem 2 applies the same Gamma-tail argument to the detection-only score S_d, and Theorem 3 multiplies the two bounds. No fitted parameter is fed back into these bounds; the thresholds tau_d and tau_k are treated as given operating points, and the only assumption beyond uniformity is independence of the hash-derived u_i(xi), which is stated as the random-oracle abstraction. The empirical validation uses a development set for threshold selection and a separate test set for evaluation, so the reported FPR improvements are not constructed from the theory's own conclusions. Self-citation is limited to contextual references to prior watermarking work and is not load-bearing for the new claims. The paper does assert, without proof, that FKE's false positives grow 'provided the False Negative Ratio (FNR) is held constant' (Section 1), and the theorems only establish fixed-threshold bounds rather than a matched-FNR comparison. This is a genuine correctness/support gap, but it is not circularity: the bounds are not defined in terms of the FKE false positive rate, and the DW/HDW advantage is not obtained by renaming an input assumption. The appendix's illustrative tau=1.6 values are numerical illustrations, not fitted parameters used to derive the central claims. Therefore no circular step is present.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

No physical or conceptual entities are invented; the scheme reuses existing hash/Gumbel machinery. The ledger consists of the design knobs (r_d, thresholds, window size) and the random-oracle/independence assumptions underpinning the proofs.

free parameters (4)

indication ratio r_d = 0.5 in main experiments; varied in 0.1-0.9
User-specified knob controlling the fraction of tokens encoding the detection watermark. Not fitted from data; chosen by hand and explored in A.17-A.18.
detection threshold tau_d = grid-searched in [0.02, 8.0] on dev set
Tuned per watermark ratio to maximize development-set accuracy; a free operating point that affects FPR/FNR tradeoff.
identification threshold tau_k = grid-searched in [0.02, 8.0] on dev set
Tuned per watermark ratio in the same way as tau_d.
hash window h = not fixed in main text; explored in A.20
Number of previous tokens feeding the hash; affects robustness and score distribution, not specified precisely.

assumptions (3)

domain assumption The hash function H behaves as a random oracle, producing independent uniform u_i(xi) for all keys and for unwatermarked text.
Invoked throughout Section 3.4 and Theorem 1-3 proofs; if hashes are correlated or non-uniform, the claimed distributions fail.
domain assumption For unwatermarked text the recovered random variables are i.i.d. Uniform(0,1) independent of the language model.
Assumed in Theorem 1/2/3 when deriving false positive bounds; this is the standard watermarking model but not explicitly defended in the paper.
standard math Scores on detection tokens (d_i=0) and identification tokens (d_i=1) are independent, so the HDW joint probability factors.
Used in Theorem 3 to factor Pr(S_d >= tau_d AND max S_k >= tau_k); requires the hash-based token split to be independent of the Gumbel variables.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Multi-use LLM Watermarking and the False Detection Problem." pith.science (2026). https://pith.science/paper/WU2AKPPI

@misc{pith2026250615975,
  author       = {Pith},
  title        = {Pith review of: Multi-use LLM Watermarking and the False Detection Problem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WU2AKPPI}},
  note         = {Machine review of arXiv:2506.15975}
}

read the original abstract

Digital watermarking is a promising solution for mitigating some of the risks arising from the misuse of automatically generated text. These approaches either embed non-specific watermarks to allow for the detection of any text generated by a particular sampler, or embed specific keys that allow the identification of the LLM user. However, simultaneously using the same embedding for both detection and user identification leads to a false detection problem, whereby, as user capacity grows, unwatermarked text is increasingly likely to be falsely detected as watermarked. Through theoretical analysis, we identify the underlying causes of this phenomenon. Building on these insights, we propose Dual Watermarking which jointly encodes detection and identification watermarks into generated text, significantly reducing false positives while maintaining high detection accuracy. Our experimental results validate our theoretical findings and demonstrate the effectiveness of our approach.

Figures

Figures reproduced from arXiv: 2506.15975 by the authors.

**Figure 1.** Numerical comparison of the probability bounds for DW and FKE methods, presenting the numerical bounds for Theorem 1 and Theorem 2. To compare FKE and DW methods, we conducted a numerical experiment by plotting the probability bound for Theorem 1 with K ranging from 50 to 500, and the probability bound for Theorem 2 with rd ranging from 0.2 to 0.8, as shown in [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗

**Figure 2.** Distribution of Cpt with respect to different walues of b. A.9 Numerical Bound Analysis Since the number of tokens used in the DW method is smaller than that used in FKE, we numerically calculated the minimal K value for which DW’s bound outperforms FKE’s bound, given specific T and r. As shown in [PITH_FULL_IMAGE:figures/full_fig_p023_2.png] view at source ↗

**Figure 3.** Watermarked text ratio results. The figures illustrate the relationship between the watermarked [PITH_FULL_IMAGE:figures/full_fig_p024_3.png] view at source ↗

Figures from the paper (11 more)

**Figure 4.** Figure 4: Dictionary-based watermarked text ratio results. All models are based on Multi-bit. The figures [PITH_FULL_IMAGE:figures/full_fig_p024_4.png]

**Figure 5.** Figure 5: Insertion attack results. The figure shows the impact of varying insertion ratios (10% to 90%) on [PITH_FULL_IMAGE:figures/full_fig_p025_5.png]

**Figure 6.** Figure 6: Deletion attack results. The figure illustrates the effect of varying deletion ratios (10% to 90%) on [PITH_FULL_IMAGE:figures/full_fig_p025_6.png]

**Figure 7.** Figure 7: Paraphrase attack results. The figure compares the performance of watermarking methods (FKE, [PITH_FULL_IMAGE:figures/full_fig_p026_7.png]

**Figure 8.** Figure 8: Runtime analysis. The left plot shows the generation time, while the right plot shows the detection [PITH_FULL_IMAGE:figures/full_fig_p026_8.png]

**Figure 9.** Figure 9: Sequence Length Analysis. The figure presents the impact of sequence length (ranging from 20 to [PITH_FULL_IMAGE:figures/full_fig_p027_9.png]

**Figure 10.** Figure 10: Experiment results with varying indication ratio parameter [PITH_FULL_IMAGE:figures/full_fig_p028_10.png]

**Figure 11.** Figure 11: Relationship between FPR and r. Each curve represents a specific r value. 20 40 60 80 watermarked text ratio. 0.0 0.2 0.4 FPR 2000 1000 500 200 100 [PITH_FULL_IMAGE:figures/full_fig_p028_11.png]

**Figure 13.** Figure 13: Text quality with respect to different window sizes [PITH_FULL_IMAGE:figures/full_fig_p029_13.png]

**Figure 14.** Figure 14: Key capacity results for FKE (left) and HDW (right). The figures illustrate the relationship [PITH_FULL_IMAGE:figures/full_fig_p029_14.png]

**Figure 15.** Figure 15: Dictionary-based model’s key capacity results for FKE (left) and HDW (right). All models based [PITH_FULL_IMAGE:figures/full_fig_p030_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

17 extracted references · 8 canonical work pages

[1]

Now, substituteb=s: δ= exp T s 1 e−1 + 1

= logδ, δ= exp (T(b(1/e−1) + 1)). Now, substituteb=s: δ= exp T s 1 e−1 + 1 . Hence: Pr max i ui≤s ≥ 1−exp T s 1 e−1 + 1 K . This completes the proof of the lemma. 19 Lemma 5.Given a random variableX, such that with probability1−δ: X≤ logδ rdT −1 1/e−1 , it follows that: Pr (X≤s)≥1−exp rdT s 1 e−1 + 1 . Proof.Given the condition: Pr X≤ logδ rdT −1 1/e−1 ! ...

work page 2024
[4]

This observation further highlights the extensibility of our method across different backbones

From the results, it can be observed that the trends for Accu-I, Accu-O, and FPR are similar to those observed in the experiments in Section A.10, demonstrating that our method performs effectively in the dictionary-based approach. This observation further highlights the extensibility of our method across different backbones. 0 20 40 60 80 100 watermarked...

work page 2023
[5]

On the reliability of watermarks for large language models.arXiv preprint arXiv:2306.04634, 2023a

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models.arXiv preprint arXiv:2306.04634, 2023a. KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit watermark for languag...

arXiv
[6]

Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick.arXiv preprint arXiv:2402.12948,

Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick.arXiv preprint arXiv:2402.12948,

arXiv
[7]

Robust multi-bit natural language watermarking through invariant features

KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust multi-bit natural language watermarking through invariant features. InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2092–2115, 2023b. Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun...

arXiv
[8]

Multi-bit distortion-free watermarking for large language models.arXiv preprint arXiv:2402.16578,

Massieh Kordi Boroujeny, Ya Jiang, Kai Zeng, and Brian Mark. Multi-bit distortion-free watermarking for large language models.arXiv preprint arXiv:2402.16578,

arXiv
[9]

Provably robust multi-bit watermarking for ai-generated text via error correction code.arXiv preprint arXiv:2401.16820,

Wenjie Qu, Dong Yin, Zixin He, Wei Zou, Tianyang Tao, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for ai-generated text via error correction code.arXiv preprint arXiv:2401.16820,

arXiv
[10]

The findings are summarized as follows: (1) Asrd increases, both DW and HDW exhibit an improvement in the Accu-I score. This demonstrates that using more tokens to encode the indicator variable enhances the accuracy of detecting whether the text is watermarked, thereby validating the correctness of our proposed method and theoretical analysis. (2) With an...

work page 2000

Show all 17 references

[12]

green list

extended Kirchenbauer et al. [2023b]’s method to support multi-bit encoding. Their approach detects if a text is watermarked by use of a binomial statistic [Yoo et al., 2023a]. However, since the statistic is based on the maximal value of multiple binomial variables, it should...

2000
[14]

NoWatermark

We can observe that (1) our proposed DW and HDW models outperform the FKE method, (2) although accuracy decreases after the paraphrase attack, it remains above 0.5, indicating that the methods can still recognize watermarked text and associated keys, and (3) the FPR decreases ...

2000
[71]

2 4 6 8 h 0.60 0.65 0.70 0.75 0.80Sim FKE DWI HDWI Figure 13: Text quality with respect to different window sizesh

In this experiment, no substantial changes in text quality were observed as the window sizehvaried. 2 4 6 8 h 0.60 0.65 0.70 0.75 0.80Sim FKE DWI HDWI Figure 13: Text quality with respect to different window sizesh. A.21 Key Capacity Breakdown Results We conduct the key capaci...

2000
[200]

We evaluated our models on these datasets, and the results are presented in Table 5 and Table

A.16 Experiments with More Datasets To demonstrate the applicability of our model across different scenarios, we conducted experiments on two domain-specific datasets: a biomedical question dataset, BioASQ [Krithara et al., 2023], and a legal dataset, LegalQA2. We evaluated ou...

2023
[2014]

Categorical reparameterization with gumbel-softmax.arXiv preprint arXiv:1611.01144,

Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterization with gumbel-softmax.arXiv preprint arXiv:1611.01144,

arXiv
[2019]

Language models are few-shot learners

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877–1901,

1901
[2020]

Gpt-4 technical report.arXiv preprint arXiv:2303.08774,

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774,

arXiv
[2023]

Llama: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971, 2023a

Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971, 2023a. Hugo Touvron, Lou...

arXiv
[2024]

Poisoning scientific knowledge using large language models.bioRxiv, pages 2023–11,

Junwei Yang, Hanwen Xu, Srbuhi Mirzoyan, Tong Chen, Zixuan Liu, Wei Ju, Luchen Liu, Ming Zhang, and Sheng Wang. Poisoning scientific knowledge using large language models.bioRxiv, pages 2023–11,

2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Now, substituteb=s: δ= exp T s 1 e−1 + 1

= logδ, δ= exp (T(b(1/e−1) + 1)). Now, substituteb=s: δ= exp T s 1 e−1 + 1 . Hence: Pr max i ui≤s ≥ 1−exp T s 1 e−1 + 1 K . This completes the proof of the lemma. 19 Lemma 5.Given a random variableX, such that with probability1−δ: X≤ logδ rdT −1 1/e−1 , it follows that: Pr (X≤s)≥1−exp rdT s 1 e−1 + 1 . Proof.Given the condition: Pr X≤ logδ rdT −1 1/e−1 ! ...

work page 2024

[2] [4]

This observation further highlights the extensibility of our method across different backbones

From the results, it can be observed that the trends for Accu-I, Accu-O, and FPR are similar to those observed in the experiments in Section A.10, demonstrating that our method performs effectively in the dictionary-based approach. This observation further highlights the extensibility of our method across different backbones. 0 20 40 60 80 100 watermarked...

work page 2023

[3] [5]

On the reliability of watermarks for large language models.arXiv preprint arXiv:2306.04634, 2023a

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models.arXiv preprint arXiv:2306.04634, 2023a. KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit watermark for languag...

arXiv

[4] [6]

Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick.arXiv preprint arXiv:2402.12948,

Jiayi Fu, Xuandong Zhao, Ruihan Yang, Yuansen Zhang, Jiangjie Chen, and Yanghua Xiao. Gumbelsoft: Diversified language model watermarking via the gumbelmax-trick.arXiv preprint arXiv:2402.12948,

arXiv

[5] [7]

Robust multi-bit natural language watermarking through invariant features

KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust multi-bit natural language watermarking through invariant features. InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2092–2115, 2023b. Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun...

arXiv

[6] [8]

Multi-bit distortion-free watermarking for large language models.arXiv preprint arXiv:2402.16578,

Massieh Kordi Boroujeny, Ya Jiang, Kai Zeng, and Brian Mark. Multi-bit distortion-free watermarking for large language models.arXiv preprint arXiv:2402.16578,

arXiv

[7] [9]

Provably robust multi-bit watermarking for ai-generated text via error correction code.arXiv preprint arXiv:2401.16820,

Wenjie Qu, Dong Yin, Zixin He, Wei Zou, Tianyang Tao, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for ai-generated text via error correction code.arXiv preprint arXiv:2401.16820,

arXiv

[8] [10]

The findings are summarized as follows: (1) Asrd increases, both DW and HDW exhibit an improvement in the Accu-I score. This demonstrates that using more tokens to encode the indicator variable enhances the accuracy of detecting whether the text is watermarked, thereby validating the correctness of our proposed method and theoretical analysis. (2) With an...

work page 2000