MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

Yizhou Zhao; Zhiwei Steven Wu; Adam Block

cs.LGDec 3, 2025

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

Authors: Yizhou Zhao, Zhiwei Steven Wu, Adam Block

Organizations: University of Pennsylvania · Carnegie Mellon University · Columbia University

Abstract

Language model watermarking schemes fall into two broad categories: inference-time methods, which modify the decoding process at generation time, and model-embedded methods, which encode a secret signal directly into the model weights. Inference-time watermarking methods incur additional inference overhead and are not applicable in the increasingly prevalent open-weight model settings. In contrast, model-embedded watermarks introduce no additional inference latency-generation uses the standard sampling pipeline-and are particularly well-suited to open-weight settings. However, existing model-embedded approaches such as GaussMark face a fundamental quality-detectability trade-off: achieving strong detection power typically requires weight perturbations that noticeably degrade generation quality. Our key insight is that regularizing toward a high-quality reference distribution decouples quality preservation from proximity to the base model, enabling a better quality-detectability trade-off. Building on this insight, we introduce MarkTune, a theoretically grounded on-policy fine-tuning framework that uses the GaussMark detection statistic as a reward while preserving generation quality through cross-entropy on high-quality human text or KL divergence to a stronger oracle model. Empirically, MarkTune substantially improves the quality-detectability frontier of GaussMark, approaching the detectability of strong inference-time schemes while preserving generation quality and downstream task performance. Marktune also remains robust under the evaluated text-editing and open-weight attacks and generalizes across datasets, retaining substantial detection power on corpora unseen during training. Code is available at https://github.com/zhyzmath/MarkTune-LLM-Watermarking.

Figures & tables

Figure 1: Overview of our framework compared to prior work [ 1 , 42 , 13 , 4 ] . Left : Inference-time watermarking schemes break down on open-weight LMs because users can disable the decoding algorithm, and these methods often introduce substantial generation latency ( indicates no latency; indicates extra latency). Right : Our approach, MarkTune , treats the GaussMark test statistic as a reward and performs on-policy fine-tuning to embed a highly detectable yet quality-preserving watermark signal into the model’s weights.

Panel of Figure 2 — Figure 2: Stylized one-dimensional landscape along a watermark-sensitive direction. Both $\theta_{\textsc{GaussMark}}$ and $\theta_{\textsc{MarkTune}}$ lie at nontrivial distances from the base model $\theta$ along this direction, leading to significant watermark detectability, but $\theta_{\textsc{MarkTune}}$ resides within the flat high-quality basin around $\theta^{\star}$ and therefore incurs substantially less quality degradation than $\theta_{\textsc{GaussMark}}$ .

Method	C4-RealNewsLike					ELI5
Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
Qwen3-4B-Base, T=0.7
No Watermark	0.500	0.010	$4.92_{\scriptscriptstyle 1.34}$	0.04	0.98	0.500	0.010	$2.67_{\scriptscriptstyle 0.94}$	0.03	0.94
KGW-1	0.996	0.964	$5.51_{\scriptscriptstyle 1.56}$	0.04	0.98	0.971	0.710	$3.04_{\scriptscriptstyle 1.12}$	0.04	0.92
KGW-2	1.000	0.998	$6.65_{\scriptscriptstyle 1.91}$	0.04	0.96	0.996	0.988	$3.69_{\scriptscriptstyle 1.51}$	0.03	0.87
Gumbel-max	0.995	0.980	$4.89_{\scriptscriptstyle 2.07}$	0.18	0.74	0.991	0.938	$2.71_{\scriptscriptstyle 1.01}$	0.13	0.77

Table 1: Generation quality and watermark detectability across methods, best-performing model-embedded watermarks are shown in bold .

Panel of Figure 3 — Figure 3: Quality-detectability trade-off at $200$ generated tokens. Black ‘×’ marks the MarkTune configuration used elsewhere.

Panel of Figure 4 — Figure 4: Mean wall-clock times on the first $100$ C4-RealNewsLike prompts ( $200$ -token prefix, $200$ generated tokens).

Panel of Figure 5 — Figure 5: Relative downstream task accuracy compared to unwatermarked models across general, math, and coding benchmarks.

Qwen3-4B-Base, T=0.7
Method	Del-0.2		Del-0.5		Sub-0.2		Sub-0.5		Dipper-1		Dipper-2		Translate
Method	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	AUC $\uparrow$	TPR $\uparrow$
KGW-1	0.881	0.330	0.617	0.040	0.873	0.324	0.638	0.048	0.771	0.142	0.573	0.026	0.831	0.242
KGW-2	0.975	0.746	0.697	0.082	0.986	0.826	0.747	0.106	0.884	0.372	0.616	0.038	0.928	0.552
Gumbel-max	0.993	0.948	0.778	0.162	0.993	0.922	0.840	0.348	0.945	0.748	0.721	0.146	0.955	0.846
SynthID	0.987	0.890	0.780	0.094	0.986	0.846	0.834	0.182	0.941	0.576	0.700	0.074	0.968	0.818

Table 2: Watermark detectability under text-editing and paraphrasing attacks for different methods on C4-RealNewsLike . “Del-

n

” and “Sub-

n

” denote attacks that delete or substitute a proportion of

n

tokens, respectively. “Dipper-1” refers to Dipper paraphrasing with lexical and order diversity set to 20, while “Dipper-2” uses a diversity level of 60. “Translate” denotes the roundtrip translation attack described in Section 4.3 . Best performances among model-embedded watermarks are shown in bold .

Panel of Figure 6 — Figure 6: Detectability (TPR@1%FPR) decay under LoRA fine-tuning attack.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Qwen3-4B-Base on OpenWebText
Training steps	200
GRPO inner steps	3
Regularization term	Cross-entropy (CE) regularization
Regularization coefficient $\lambda$	0.01
Optimizer	AdamW
maximal learning rate	5e-6

Appendix

Table 3: Hyperparameter setting for MarkTune on Qwen3-4B-Base.

Model	Llama2-7B on OpenWebText
Training steps	300
GRPO inner steps	3
Regularization term	Cross-entropy (CE) regularization
Regularization coefficient $\lambda$	0.005
Optimizer	AdamW
maximal learning rate	4e-6

Appendix

Table 4: Hyperparameter setting for MarkTune on Llama2-7B.

Qwen3-4B-Base
Method	Generation (ms)	Detection (ms)
GaussMark	$3371.3\pm 8.1$	$26.2\pm 0.2$
MarkTune (ours)	$3422.8\pm 5.7$	$27.0\pm 0.2$
KGW	$3714.6\pm 11.0$	$69.7\pm 0.2$
Gumbel-max	$3716.9\pm 5.4$	$175.7\pm 0.9$
SynthID	$3971.9\pm 10.2$	$35.5\pm 0.2$

Appendix

Table 5: Per-prompt watermarked generation and detection times on the first

n=100

C4-RealNewsLike prompts (

200

prompt tokens,

200

generated tokens, batch size

1

, single H200, bf16, single-prompt HuggingFace model.generate ). Means

\pm

standard deviations are computed after a

2

-prompt warm-up.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
Base	0.999	0.992	$5.88_{\scriptscriptstyle 1.55}$	0.06	0.89
+ CE-0.005	0.997	0.976	$5.35_{\scriptscriptstyle 1.43}$	0.05	0.94
+ CE-0.01	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97
+ CE-0.05	0.989	0.902	$4.97_{\scriptscriptstyle 1.31}$	0.03	0.97
+ KL-0.001	0.997	0.986	$5.69_{\scriptscriptstyle 1.56}$	0.06	0.93
+ KL-0.005	0.993	0.930	$5.36_{\scriptscriptstyle 1.41}$	0.06	0.95

Appendix

Table 8: Ablation study on regularization hyperparameters. “Base” denotes the watermarked model trained using MarkTune without a regularization term. Configuration highlighted in bold indicates Pareto-optimal performance.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
GaussMark	0.983	0.788	$5.16_{\scriptscriptstyle 1.54}$	0.04	0.98
MarkTune + KL-to-base (quality-matched)	0.986	0.796	$5.09_{\scriptscriptstyle 1.52}$	0.03	0.98
MarkTune + KL-to-base (detectability-matched)	0.993	0.940	$5.46_{\scriptscriptstyle 1.60}$	0.03	0.94
MarkTune + CE-human (default)	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97

Appendix

Table 9: Ablation on the regularization anchor (Qwen3-4B-Base, C4-RealNewsLike ). KL-to-base-model regularization fails to improve over GaussMark at matched quality and only matches MarkTune (CE-human) by sacrificing generation quality.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
No Watermark	0.500	0.010	$4.92_{\scriptscriptstyle 1.34}$	0.04	0.98
GaussMark ( $\sigma=1.6$ , init)	0.995	0.970	$5.79_{\scriptscriptstyle 1.68}$	0.05	0.93
w/o $\mathcal{R}_{\mathrm{wm}}$ (CE only, 200 steps)	0.990	0.888	$5.66_{\scriptscriptstyle 1.64}$	0.05	0.93
w/o $\mathcal{R}_{\mathrm{wm}}$ (CE only, 1000 steps)	0.973	0.726	$5.37_{\scriptscriptstyle 1.49}$	0.03	0.95
MarkTune (default)	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97

Appendix

Table 11: Removing the watermark reward

\mathcal{R}_{\mathrm{wm}}

during fine-tuning (Qwen3-4B-Base, C4-RealNewsLike ). Starting from GaussMark with

\sigma=1.6

, cross-entropy-only fine-tuning progressively erases the watermark; MarkTune Pareto-dominates the result on both detectability and quality.

G	T	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
8	0.7	0.995	0.964	$\mathbf{5.04_{\scriptscriptstyle 1.37}}$	0.03	0.97
4	0.7	0.992	0.900	$5.07_{\scriptscriptstyle 1.38}$	0.03	0.98
16	0.7	0.996	0.968	$5.11_{\scriptscriptstyle 1.42}$	0.03	0.97
8	0.5	0.983	0.820	$4.98_{\scriptscriptstyle 1.28}$	0.06	0.92
8	1.0	0.992	0.940	$6.21_{\scriptscriptstyle 2.26}$	0.03	0.94

Appendix

Table 12: Ablation study on GRPO sampling hyperparameters group size (“ G ”) and temperature (“ T ”). Configuration highlighted in bold indicates Pareto-optimal performance.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
No Watermark	0.500	0.010	$4.92_{\scriptscriptstyle 1.34}$	0.04	0.98
KGW ( $\gamma=0.5,\,\delta=0.6$ )	0.935	0.513	$4.95_{\scriptscriptstyle 1.44}$	0.04	0.98
KGW ( $\gamma=0.5,\,\delta=0.8$ )	0.987	0.861	$5.14_{\scriptscriptstyle 1.50}$	0.05	0.98
MarkTune (KGW reward)	0.991	0.906	$\mathbf{5.09_{\scriptscriptstyle 1.49}}$	0.06	0.98
MarkTune ( GaussMark reward, default)	0.995	0.964	$5.04_{\scriptscriptstyle 1.37}$	0.03	0.97

Appendix

Table 13: MarkTune with the KGW

z

-score as reward (Qwen3-4B-Base, C4-RealNewsLike ). MarkTune (KGW) improves on KGW (

\delta=0.8

) in both detectability and quality.

Target	TPR	PPL	Seq-rep-3
Qwen3-4B-Base
L26 mlp.up_proj	0.822	$5.28_{\scriptscriptstyle 1.81}$	0.04
L28 mlp.up_proj (default)	0.788	$5.16_{\scriptscriptstyle 1.54}$	0.04
L30 mlp.up_proj	0.808	$5.47_{\scriptscriptstyle 1.88}$	0.05
L28 mlp.down_proj	0.610	$5.66_{\scriptscriptstyle 1.86}$	0.05
Llama2-7B

Appendix

Table 14: Watermarking performance for nearby parameter matrices. TPR is measured at 1% FPR; PPL subscripts denote standard deviations.

Mismatched key	$\xi_{1}$	$\xi_{2}$	$\xi_{3}$	$\xi_{4}$	$\xi_{5}$	$\xi_{6}$	$\xi_{7}$	$\xi_{8}$	$\xi_{9}$	$\xi_{10}$
TPR@1%FPR	0.012	0.008	0.014	0.014	0.010	0.012	0.012	0.014	0.010	0.012

Appendix

Table 16: Cross-key detection on Qwen3-4B-Base/ C4-RealNewsLike : each cell reports TPR@1%FPR when the detector uses a key

\xi_{i}

different from the key

\xi^{\star}

used to watermark the generator. All entries lie at or near the nominal

\alpha=0.01

level.

Method	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	Seq-rep-3 $\downarrow$	MAUVE $\uparrow$
No Watermark	0.500	0.010	$6.55_{\scriptscriptstyle 1.80}$	0.01	0.98
MarkTune (teacher)	0.997	0.982	$6.75_{\scriptscriptstyle 1.96}$	0.01	0.96
Distilled student	0.991	0.916	$6.81_{\scriptscriptstyle 1.92}$	0.01	0.96

Appendix

Table 23: Same-architecture logit-based distillation: a Llama2-7B student distilled from a MarkTune -trained Llama2-7B teacher ( C4-RealNewsLike ). The student inherits substantial detectability without quality loss; the smaller-student case is left to future work.

Panel of Figure 7 — Figure 7: Watermark reward ( GaussMark test statistic) averaged over rollouts during MarkTune training.

Qwen3-4B-Base, T=0.7
Attack	Metric	KGW-1	KGW-2	Gumbel-max	SynthID	KGW-D	GaussMark	MarkTune
Del-0.2	AUC $\uparrow$	0.881	0.975	0.993	0.987	0.947	0.908	0.921
	TPR $\uparrow$	0.330	0.746	0.948	0.890	0.582	0.366	0.484
	PPL $\downarrow$	20.50	25.19	18.82	19.15	21.23	19.49	19.39
Del-0.5	AUC $\uparrow$	0.617	0.697	0.778	0.780	0.851	0.622	0.744
	TPR $\uparrow$	0.040	0.082	0.162	0.094	0.196	0.048	0.068

Appendix

Table 24: Extension of Table 2 with perplexity (PPL) to validate attack plausibility.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

OpenStamp: A Watermark for Open-Source Language Models
Aug 28, 2026Miroojin Bakshi, Saksham Rastogi, Danish PruthiText Watermarking LLM Watermarking
Indian Institute of Science · Carnegie Mellon University
Language Model Fingerprinting Requires Rethinking Watermark Teachers
Oct 3, 2026Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1Language Model Fingerprinting Fingerprint Identification
Pohang University of Science and Technology · University of Washington
ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models
Oct 19, 2026Yupeng Qiu, Han Fang, Ee-Chien ChangLLM Watermarking Robust Watermarking
School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui, China

Aug 28, 2026J/K move · Enter open · S save

OpenStamp: A Watermark for Open-Source Language Models

Miroojin Bakshi, Saksham Rastogi, Danish Pruthi

Indian Institute of Science · Carnegie Mellon University

Text Watermarking LLM Watermarking Robust Watermarking

Open paper AskPDF arXiv

With the growing prevalence of large language model (LLM) generated content, watermarking is considered a promising approach for attributing text to LLMs and distinguishing it from human-written content. A prominent class of techniques embeds subtle but detectable signals in generated text by modifying token sampling probabilities. However, such methods are unsuitable for open-source models, where users have white-box access and can easily disable watermarking during inference. In this work, we introduce OpenStamp, a watermarking technique that encodes the watermarking logic directly into the model weights by modifying only the final projection, or unembedding, layer. Through experiments across two models, we show that OpenStamp achieves superior detection performance, with minimal degradation in model capabilities compared to prior methods. The implanted watermark is explicitly designed, and empirically confirmed, to be more robust to paraphrasing attacks and harder to scrub off through post-hoc fine-tuning than prior open-source watermarks. To enable developers to watermark their models, we release our code alongside watermarked versions of 4 popular open-source models.

Abstract

LLM Watermarking

Explore similar work

OpenStamp: A Watermark for Open-Source Language Models

Language Model Fingerprinting Requires Rethinking Watermark Teachers

ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models