MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

Yizhou Zhao; Zhiwei Steven Wu; Adam Block

cs.LGDec 3, 2025

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

Authors: Yizhou Zhao, Zhiwei Steven Wu, Adam Block

Organizations: University of Pennsylvania · Carnegie Mellon University · Columbia University

Abstract

Language model watermarking schemes fall into two broad categories: inference-time methods, which modify the decoding process at generation time, and model-embedded methods, which encode a secret signal directly into the model weights. Inference-time watermarking methods incur additional inference overhead and are not applicable in the increasingly prevalent open-weight model settings. In contrast, model-embedded watermarks introduce no additional inference latency-generation uses the standard sampling pipeline-and are particularly well-suited to open-weight settings. However, existing model-embedded approaches such as GaussMark face a fundamental quality-detectability trade-off: achieving strong detection power typically requires weight perturbations that noticeably degrade generation quality. Our key insight is that regularizing toward a high-quality reference distribution decouples quality preservation from proximity to the base model, enabling a better quality-detectability trade-off. Building on this insight, we introduce MarkTune, a theoretically grounded on-policy fine-tuning framework that uses the GaussMark detection statistic as a reward while preserving generation quality through cross-entropy on high-quality human text or KL divergence to a stronger oracle model. Empirically, MarkTune substantially improves the quality-detectability frontier of GaussMark, approaching the detectability of strong inference-time schemes while preserving generation quality and downstream task performance. Marktune also remains robust under the evaluated text-editing and open-weight attacks and generalizes across datasets, retaining substantial detection power on corpora unseen during training. Code is available at https://github.com/zhyzmath/MarkTune-LLM-Watermarking.

Figures & tables

Figure 1: Overview of our framework compared to prior work [ 1 , 42 , 13 , 4 ] . Left : Inference-time watermarking schemes break down on open-weight LMs because users can disable the decoding algorithm, and these methods often introduce substantial generation latency ( indicates no latency; indicates extra latency). Right : Our approach, MarkTune , treats the GaussMark test statistic as a reward and performs on-policy fine-tuning to embed a highly detectable yet quality-preserving watermark signal into the model’s weights.

Panel of Figure 2 — Figure 2: Stylized one-dimensional landscape along a watermark-sensitive direction. Both $\theta_{\textsc{GaussMark}}$ and $\theta_{\textsc{MarkTune}}$ lie at nontrivial distances from the base model $\theta$ along this direction, leading to significant watermark detectability, but $\theta_{\textsc{MarkTune}}$ resides within the flat high-quality basin around $\theta^{\star}$ and therefore incurs substantially less quality degradation than $\theta_{\textsc{GaussMark}}$ .

Method	C4-RealNewsLike					ELI5
Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
Qwen3-4B-Base, T=0.7
No Watermark	0.500	0.010	$4.92_{\scriptscriptstyle 1.34}$	0.04	0.98	0.500	0.010	$2.67_{\scriptscriptstyle 0.94}$	0.03	0.94
KGW-1	0.996	0.964	$5.51_{\scriptscriptstyle 1.56}$	0.04	0.98	0.971	0.710	$3.04_{\scriptscriptstyle 1.12}$	0.04	0.92
KGW-2	1.000	0.998	$6.65_{\scriptscriptstyle 1.91}$	0.04	0.96	0.996	0.988	$3.69_{\scriptscriptstyle 1.51}$	0.03	0.87
Gumbel-max	0.995	0.980	$4.89_{\scriptscriptstyle 2.07}$	0.18	0.74	0.991	0.938	$2.71_{\scriptscriptstyle 1.01}$	0.13	0.77

Table 1: Generation quality and watermark detectability across methods, best-performing model-embedded watermarks are shown in bold .

Panel of Figure 3 — Figure 3: Quality-detectability trade-off at $200$ generated tokens. Black ‘×’ marks the MarkTune configuration used elsewhere.

Panel of Figure 4 — Figure 4: Mean wall-clock times on the first $100$ C4-RealNewsLike prompts ( $200$ -token prefix, $200$ generated tokens).

Panel of Figure 5 — Figure 5: Relative downstream task accuracy compared to unwatermarked models across general, math, and coding benchmarks.

Qwen3-4B-Base, T=0.7
Method	Del-0.2		Del-0.5		Sub-0.2		Sub-0.5		Dipper-1		Dipper-2		Translate
Method	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$
KGW-1	0.881	0.330	0.617	0.040	0.873	0.324	0.638	0.048	0.771	0.142	0.573	0.026	0.831	0.242
KGW-2	0.975	0.746	0.697	0.082	0.986	0.826	0.747	0.106	0.884	0.372	0.616	0.038	0.928	0.552
Gumbel-max	0.993	0.948	0.778	0.162	0.993	0.922	0.840	0.348	0.945	0.748	0.721	0.146	0.955	0.846
SynthID	0.987	0.890	0.780	0.094	0.986	0.846	0.834	0.182	0.941	0.576	0.700	0.074	0.968	0.818

Table 2: Watermark detectability under text-editing and paraphrasing attacks for different methods on C4-RealNewsLike . “Del-

n

” and “Sub-

n

” denote attacks that delete or substitute a proportion of

n

tokens, respectively. “Dipper-1” refers to Dipper paraphrasing with lexical and order diversity set to 20, while “Dipper-2” uses a diversity level of 60. “Translate” denotes the roundtrip translation attack described in Section 4.3 . Best performances among model-embedded watermarks are shown in bold .

Panel of Figure 6 — Figure 6: Detectability (TPR@1%FPR) decay under LoRA fine-tuning attack.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Qwen3-4B-Base on OpenWebText
Training steps	200
GRPO inner steps	3
Regularization term	Cross-entropy (CE) regularization
Regularization coefficient $\lambda$	0.01
Optimizer	AdamW
maximal learning rate	5e-6

Appendix

Table 3: Hyperparameter setting for MarkTune on Qwen3-4B-Base.

Model	Llama2-7B on OpenWebText
Training steps	300
GRPO inner steps	3
Regularization term	Cross-entropy (CE) regularization
Regularization coefficient $\lambda$	0.005
Optimizer	AdamW
maximal learning rate	4e-6

Appendix

Table 4: Hyperparameter setting for MarkTune on Llama2-7B.

Qwen3-4B-Base
Method	Generation (ms)	Detection (ms)
GaussMark	$3371.3\pm 8.1$	$26.2\pm 0.2$
MarkTune (ours)	$3422.8\pm 5.7$	$27.0\pm 0.2$
KGW	$3714.6\pm 11.0$	$69.7\pm 0.2$
Gumbel-max	$3716.9\pm 5.4$	$175.7\pm 0.9$
SynthID	$3971.9\pm 10.2$	$35.5\pm 0.2$

Appendix

Table 5: Per-prompt watermarked generation and detection times on the first

n=100

C4-RealNewsLike prompts (

200

prompt tokens,

200

generated tokens, batch size

1

, single H200, bf16, single-prompt HuggingFace model.generate ). Means

\pm

standard deviations are computed after a

2

-prompt warm-up.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
Base	0.999	0.992	$5.88_{\scriptscriptstyle 1.55}$	0.06	0.89
+ CE-0.005	0.997	0.976	$5.35_{\scriptscriptstyle 1.43}$	0.05	0.94
+ CE-0.01	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97
+ CE-0.05	0.989	0.902	$4.97_{\scriptscriptstyle 1.31}$	0.03	0.97
+ KL-0.001	0.997	0.986	$5.69_{\scriptscriptstyle 1.56}$	0.06	0.93
+ KL-0.005	0.993	0.930	$5.36_{\scriptscriptstyle 1.41}$	0.06	0.95

Appendix

Table 8: Ablation study on regularization hyperparameters. “Base” denotes the watermarked model trained using MarkTune without a regularization term. Configuration highlighted in bold indicates Pareto-optimal performance.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
GaussMark	0.983	0.788	$5.16_{\scriptscriptstyle 1.54}$	0.04	0.98
MarkTune + KL-to-base (quality-matched)	0.986	0.796	$5.09_{\scriptscriptstyle 1.52}$	0.03	0.98
MarkTune + KL-to-base (detectability-matched)	0.993	0.940	$5.46_{\scriptscriptstyle 1.60}$	0.03	0.94
MarkTune + CE-human (default)	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97

Appendix

Table 9: Ablation on the regularization anchor (Qwen3-4B-Base, C4-RealNewsLike ). KL-to-base-model regularization fails to improve over GaussMark at matched quality and only matches MarkTune (CE-human) by sacrificing generation quality.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
No Watermark	0.500	0.010	$4.92_{\scriptscriptstyle 1.34}$	0.04	0.98
GaussMark ( $\sigma=1.6$ , init)	0.995	0.970	$5.79_{\scriptscriptstyle 1.68}$	0.05	0.93
w/o $\mathcal{R}_{\mathrm{wm}}$ (CE only, 200 steps)	0.990	0.888	$5.66_{\scriptscriptstyle 1.64}$	0.05	0.93
w/o $\mathcal{R}_{\mathrm{wm}}$ (CE only, 1000 steps)	0.973	0.726	$5.37_{\scriptscriptstyle 1.49}$	0.03	0.95
MarkTune (default)	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97

Appendix

Table 11: Removing the watermark reward

\mathcal{R}_{\mathrm{wm}}

during fine-tuning (Qwen3-4B-Base, C4-RealNewsLike ). Starting from GaussMark with

\sigma=1.6

, cross-entropy-only fine-tuning progressively erases the watermark; MarkTune Pareto-dominates the result on both detectability and quality.

G	T	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
8	0.7	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97
4	0.7	0.992	0.900	$5.07_{\scriptscriptstyle 1.38}$	0.03	0.98
16	0.7	0.996	0.968	$5.11_{\scriptscriptstyle 1.42}$	0.03	0.97
8	0.5	0.983	0.820	$4.98_{\scriptscriptstyle 1.28}$	0.06	0.92
8	1.0	0.992	0.940	$6.21_{\scriptscriptstyle 2.26}$	0.03	0.94

Appendix

Table 12: Ablation study on GRPO sampling hyperparameters group size (“ G ”) and temperature (“ T ”). Configuration highlighted in bold indicates Pareto-optimal performance.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
No Watermark	0.500	0.010	$4.92_{\scriptscriptstyle 1.34}$	0.04	0.98
KGW ( $\gamma=0.5,\,\delta=0.6$ )	0.935	0.513	$4.95_{\scriptscriptstyle 1.44}$	0.04	0.98
KGW ( $\gamma=0.5,\,\delta=0.8$ )	0.987	0.861	$5.14_{\scriptscriptstyle 1.50}$	0.05	0.98
MarkTune (KGW reward)	0.991	0.906	$\mathbf{5.09_{\scriptscriptstyle 1.49}}$	0.06	0.98
MarkTune ( GaussMark reward, default)	0.995	0.964	$5.04_{\scriptscriptstyle 1.37}$	0.03	0.97

Appendix

Table 13: MarkTune with the KGW

z

-score as reward (Qwen3-4B-Base, C4-RealNewsLike ). MarkTune (KGW) improves on KGW (

\delta=0.8

) in both detectability and quality.

Target	TPR	PPL	Seq-rep-3
Qwen3-4B-Base
L26 mlp.up_proj	0.822	$5.28_{\scriptscriptstyle 1.81}$	0.04
L28 mlp.up_proj (default)	0.788	$5.16_{\scriptscriptstyle 1.54}$	0.04
L30 mlp.up_proj	0.808	$5.47_{\scriptscriptstyle 1.88}$	0.05
L28 mlp.down_proj	0.610	$5.66_{\scriptscriptstyle 1.86}$	0.05
Llama2-7B

Appendix

Table 14: Watermarking performance for nearby parameter matrices. TPR is measured at 1% FPR; PPL subscripts denote standard deviations.

Mismatched key	$\xi_{1}$	$\xi_{2}$	$\xi_{3}$	$\xi_{4}$	$\xi_{5}$	$\xi_{6}$	$\xi_{7}$	$\xi_{8}$	$\xi_{9}$	$\xi_{10}$
TPR@1%FPR	0.012	0.008	0.014	0.014	0.010	0.012	0.012	0.014	0.010	0.012

Appendix

Table 16: Cross-key detection on Qwen3-4B-Base/ C4-RealNewsLike : each cell reports TPR@1%FPR when the detector uses a key

\xi_{i}

different from the key

\xi^{\star}

used to watermark the generator. All entries lie at or near the nominal

\alpha=0.01

level.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
No Watermark	0.500	0.010	$6.55_{\scriptscriptstyle 1.80}$	0.01	0.98
MarkTune (teacher)	0.997	0.982	$6.75_{\scriptscriptstyle 1.96}$	0.01	0.96
Distilled student	0.991	0.916	$6.81_{\scriptscriptstyle 1.92}$	0.01	0.96

Appendix

Table 23: Same-architecture logit-based distillation: a Llama2-7B student distilled from a MarkTune -trained Llama2-7B teacher ( C4-RealNewsLike ). The student inherits substantial detectability without quality loss; the smaller-student case is left to future work.

Panel of Figure 7 — Figure 7: Watermark reward ( GaussMark test statistic) averaged over rollouts during MarkTune training.

Qwen3-4B-Base, T=0.7
Attack	Metric	KGW-1	KGW-2	Gumbel-max	SynthID	KGW-D	GaussMark	MarkTune
Del-0.2	AUC $\uparrow$	0.881	0.975	0.993	0.987	0.947	0.908	0.921
	TPR $\uparrow$	0.330	0.746	0.948	0.890	0.582	0.366	0.484
	PPL $\downarrow$	20.50	25.19	18.82	19.15	21.23	19.49	19.39
Del-0.5	AUC $\uparrow$	0.617	0.697	0.778	0.780	0.851	0.622	0.744
	TPR $\uparrow$	0.040	0.082	0.162	0.094	0.196	0.048	0.068

Appendix

Table 24: Extension of Table 2 with perplexity (PPL) to validate attack plausibility.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

Aug 28, 2026

OpenStamp: A Watermark for Open-Source Language Models

With the growing prevalence of large language model (LLM) generated content, watermarking is considered a promising approach for attributing text to LLMs and distinguishing it from human-written content. A prominent class of techniques embeds subtle but detectable signals in generated text by modifying token sampling probabilities. However, such methods are unsuitable for open-source models, where users have white-box access and can easily disable watermarking during inference. In this work, we introduce OpenStamp, a watermarking technique that encodes the watermarking logic directly into the model weights by modifying only the final projection, or unembedding, layer. Through experiments across two models, we show that OpenStamp achieves superior detection performance, with minimal degradation in model capabilities compared to prior methods. The implanted watermark is explicitly designed, and empirically confirmed, to be more robust to paraphrasing attacks and harder to scrub off through post-hoc fine-tuning than prior open-source watermarks. To enable developers to watermark their models, we release our code alongside watermarked versions of 4 popular open-source models.

Miroojin Bakshi, Saksham Rastogi, Danish Pruthi

Indian Institute of Science · Carnegie Mellon University

Text Watermarking LLM Watermarking Robust Watermarking

Ask PDF

Oct 3, 2026

Language Model Fingerprinting Requires Rethinking Watermark Teachers

LLM fingerprinting via watermark distillation embeds a statistical watermark signal into model weights, enabling model owners to identify their models behind black-box APIs. Revisiting a recent protocol, we find that its utility evaluation understates text quality degradation in open-ended generation, favoring overly strong watermark teachers. Weakening the watermark improves text quality but sacrifices detectability. To move beyond this trade-off, we rethink whether text watermarks designed for verifying generated text are suitable distillation teachers for model fingerprinting. Such watermarks are typically designed to remain detectable from an individual output, limiting how sparse the watermark signal can be. In contrast, fingerprint verification can aggregate signal across queries, making sparser watermark signals viable. This raises a key question: where should the sparse signal be placed? We analyze signal placement through token surprisal and show that, even at comparable watermark strength, different placements can target tokens with different plausibility under the base model. This motivates near-tie restriction, which uses top-1-relative logit gaps to restrict the watermark bias to tokens close to the base model's top prediction. Across multiple models, near-tie improves detection--quality frontiers under deployment changes, preserves higher text quality across query budgets, and further improves existing watermarking schemes when combined with them.

Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1

Pohang University of Science and Technology · University of Washington

Language Model Fingerprinting Fingerprint Identification LLM Watermarking Text Watermarking Language Model Distillation

Ask PDF

Oct 19, 2026

ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models

Large language model (LLM) watermarking operates on the next-token distribution that evolves during generation. In streaming generation, each sampled token becomes part of the text and affects subsequent distributions. Embedding therefore proceeds with a changing host, unlike classical watermarking, which adapts embedding to an existing host signal. To accommodate this difference, we formulate a novel embedding framework for LLM watermarking based on two principles. We first argue that embedding should be adaptive, retaining the state of previous sampling decisions to better guide subsequent choices. We further argue that embedding should be host-dependent, using the current LLM distribution to constrain both token selection and state updates. Guided by these principles and the two requirements of distribution preservation and robustness to text editing, we propose ClockMark. It combines adaptive and host-dependent embedding with message spreading, embedding the full payload in each watermarked token. Theoretically, we prove that ClockMark preserves the original LLM sequence distribution, thereby maintaining generation quality. Empirically, extensive experiments against 12 baselines demonstrate improved robustness to text editing, with gains of up to 16.08 percentage points in bit accuracy over the strongest tested baseline.

Yupeng Qiu, Han Fang, Ee-Chien Chang

School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui, China

LLM Watermarking Robust Watermarking Multi-Bit Watermarking

Ask PDF

Abstract

LLM Watermarking

Explore similar work

OpenStamp: A Watermark for Open-Source Language Models

Language Model Fingerprinting Requires Rethinking Watermark Teachers

ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models