Unforgeable Watermarks for Language Models via Robust Signatures

Huijia Lin; Kameron Shahabi; Min Jae Song

cs.CRFeb 17, 2026

Unforgeable Watermarks for Language Models via Robust Signatures

Authors: Huijia Lin, Kameron Shahabi, Min Jae Song

Organizations: Paul G. Allen School of Computer Science & Engineering, University of Washington · Data Science Institute, University of Chicago

Abstract

Language models now routinely produce text that is difficult to distinguish from human writing, raising the need for robust tools to verify content provenance. Watermarking has emerged as a promising countermeasure, with existing work largely focused on model quality preservation and robust detection. However, current schemes provide limited protection against false attribution. We strengthen the notion of soundness by introducing two novel guarantees: unforgeability and recoverability. Unforgeability prevents adversaries from crafting false positives, texts that are far from any output from the watermarked model but are nonetheless flagged as watermarked. Recoverability provides an additional layer of protection: whenever a watermark is detected, the detector identifies the source text from which the flagged content was derived. Together, these properties strengthen content ownership by linking content exclusively to its generating model, enabling secure attribution and fine-grained traceability. We construct the first undetectable watermarking scheme that is robust, unforgeable, and recoverable with respect to substitutions (i.e., perturbations in Hamming metric). The key technical ingredient is a new cryptographic primitive called robust (or recoverable) digital signatures, which allow verification of messages that are close to signed ones, while preventing forgery of messages that are far from all previously signed messages. We show that any standard digital signature scheme can be boosted to a robust one using property-preserving hash functions (Boyle, LaVigne, and Vaikuntanathan, ITCS 2019).

Figures & tables

Figure 1: Illustration of watermarking guarantees. Correctness and soundness (blue and purple) are statistical guarantees, whereas robustness and unforgeability (green and red) can be computational. Consequently, the green and red regions may contain unwatermarked and watermarked content respectively, but no efficient adversary can find them.

Figure 2: Illustration of $\mathsf{EBC}[\Phi,n]$ -closeness. Green dotted lines indicate $\Phi$ -closeness. The string $\zeta^{*}$ is $\mathsf{EBC}[\Phi,n]$ -close to $y$ because its blocks are $\Phi$ -close to three consecutive blocks of $y$ , whereas $\zeta^{\prime}$ may be far: although $\zeta^{\prime}$ is close to a substring of $y$ of length $2n$ , this substring is not aligned with two blocks of $y$ .

Figure 3: Generic PPH recovery algorithm

Figure 4: Robust digital signature construction

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking
Dec 3, 2025Yizhou Zhao, Zhiwei Steven Wu, Adam BlockLLM Watermarking Robust Watermarking
University of Pennsylvania · Carnegie Mellon University · Columbia University
Signature filtering: a lightweight enhancement for statistical watermark detection in large language models
Jun 16, 2026Chih-Duo Hong, Yen-Pang Chen, Fang YuLLM Watermarking Robust Watermarking
National Chengchi University, Taipei, Taiwan
Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks
May 6, 2026Mohd Ruhul Ameen, Akif Islam, Nadim Mahmud +1Diffusion Model Watermarking Watermark Removal
College of Engineering and Computer Science, Marshall University, Huntington, WV, USA · Department of Computer Science and Engineering, University of Rajshahi, Rajshahi, Bangladesh · Miami University, Oxford, OH 45056, USA

Dec 3, 2025J/K move · Enter open · S save

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

Yizhou Zhao, Zhiwei Steven Wu, Adam Block

University of Pennsylvania · Carnegie Mellon University · Columbia University

LLM Watermarking Robust Watermarking Fine-Tuning

Open paper AskPDF arXiv

Language model watermarking schemes fall into two broad categories: inference-time methods, which modify the decoding process at generation time, and model-embedded methods, which encode a secret signal directly into the model weights. Inference-time watermarking methods incur additional inference overhead and are not applicable in the increasingly prevalent open-weight model settings. In contrast, model-embedded watermarks introduce no additional inference latency-generation uses the standard sampling pipeline-and are particularly well-suited to open-weight settings. However, existing model-embedded approaches such as GaussMark face a fundamental quality-detectability trade-off: achieving strong detection power typically requires weight perturbations that noticeably degrade generation quality. Our key insight is that regularizing toward a high-quality reference distribution decouples quality preservation from proximity to the base model, enabling a better quality-detectability trade-off. Building on this insight, we introduce MarkTune, a theoretically grounded on-policy fine-tuning framework that uses the GaussMark detection statistic as a reward while preserving generation quality through cross-entropy on high-quality human text or KL divergence to a stronger oracle model. Empirically, MarkTune substantially improves the quality-detectability frontier of GaussMark, approaching the detectability of strong inference-time schemes while preserving generation quality and downstream task performance. Marktune also remains robust under the evaluated text-editing and open-weight attacks and generalizes across datasets, retaining substantial detection power on corpora unseen during training. Code is available at https://github.com/zhyzmath/MarkTune-LLM-Watermarking.

Abstract

LLM Watermarking

Explore similar work

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

Signature filtering: a lightweight enhancement for statistical watermark detection in large language models

Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks