Optimal Watermark Localization in Mixed-Source Large Language Model Texts

Jose H. Blanchet; T. Tony Cai; Xiang Li; Hao Liu; Qi Long; Weijie J. Su

stat.MEAug 14, 2026

Optimal Watermark Localization in Mixed-Source Large Language Model Texts

Authors: Jose H. Blanchet, T. Tony Cai, Xiang Li, Hao Liu, Qi Long, Weijie J. Su

Organizations: Stanford University · University of Pennsylvania

Abstract

Watermarking provides a principled way to authenticate text generated by large language models (LLMs). In practice, however, the final text may be mixed-source, with watermark evidence surviving at only a subset of token positions after rewriting, insertion, deletion, or paraphrasing. Although prior work has studied global detection of watermark signals, when such signals can be localized remains unclear. We formulate watermark localization as a token-level multiple-testing problem based on pivotal statistics, with a latent indicator recording whether watermark dependence survives at each position. Under an asymptotic regime indexed by exponents for signal sparsity, next-token concentration, and effective-vocabulary growth, we derive a sharp boundary for global detection and phase transitions for discovery and classification within the class of coordinatewise pivot-based localization rules. We show that discovery is strictly harder than detection and that consistent classification is impossible across the parameter regime within this class. We then develop an adaptive thresholding method that does not require knowledge of the exponents or time-varying next-token distributions, but uses a data-driven estimate of the surviving watermark fraction. The method attains the optimal discovery boundary and near-optimal discovery power relative to homogeneous pivot-based rules. Simulations support the theoretical phase transitions, while experiments on model-generated texts demonstrate practical localization performance under common edit mechanisms.

Figures & tables

Panel of Figure 1 — Figure 1: Watermark localization under common human edits. For each final-text position $t$ , $\theta_{t}=1$ indicates a surviving watermark signal, and $\delta_{t}=1$ indicates selection by the localization method. Selected positions with $\theta_{t}=1$ are true discoveries, while those with $\theta_{t}=0$ are false discoveries.

Figure 2: LLM watermark localization under random edits. See Section 6 for details. For substitution, insertion, and deletion edits, we report intersection-over-union scores for our method (Ours) and two baselines ( AOL and WISER ) at a target false positive rate of

0.05

. Higher values indicate better localization performance.

\widehat{S}_{n}(u):=\frac{1}{n}\sum_{t=1}^{n}\mathbf{1}\{F_{0}(Y_{t})>\tau(u)\}.

(5)

Algorithm 1 SPOT : S canning P ivots O ver T hresholds

Figure 3: Empirical illustration of the dominant–core–light structure in Assumption 4.2 . We sample prompts from C4 datasets [ 41 ] and generate continuations using OPT-1.3B [ 60 ] , then compute the average ranked next-token probabilities using temperature

0.5

Figure 4: Phase transitions for different values of

\alpha\in\{0.25,0.50,0.75\}

. The discoverable region is

p<\alpha

and

p+q<1

, while the undetectable region is

\max\{p+q,\,2p+q-\alpha\}>1

. The remaining region is detectable but not discoverable, illustrating the gap between detection and localization.

Panel of Figure 5 — Figure 5: Simulation pipeline for generating the pivotal statistics $\{Y_{t}\}_{t=1}^{n}$ .

Figure 6: Empirical discovery phase-transition slices for SPOT with

\alpha\in\{0.50,0.75\}

. Each panel reports the smallest value of discovery errors defined in ( 11 ) over a calibration grid along one slice, averaged over

200

trials. The vertical dashed lines show the theoretical discovery boundary.

Figure 7: Empirical discovery heatmap diagrams for SPOT , AOL , and WISER with $n=10^{4}$ . Columns correspond to the three methods, and rows to $\alpha\in\{0.25,0.5,0.75\}$ . Each panel reports the smallest value of discovery errors in ( 11 ) on a $(p,q)$ grid, averaged over $500$ trials, with displayed values clipped at $1.05$ . White dashed lines show the theoretical discovery boundaries.

Figure 8: Localization performance under three random edit mechanisms at temperature

T=1

, measured by IoU (top row) and TPR (bottom row). Columns correspond to substitution, insertion, and deletion edits from left to right, with target FPR

0.05

. Each panel reports the mean performance as a function of the edit fraction.

Edit type	Method	IoU			TPR
Edit type	Method	$T=1$	$T=0.7$	$T=0.5$	$T=1$	$T=0.7$	$T=0.5$
Random substitution	AOL	0.0200	0.0260	0.0202	0.0282	0.0421	0.0437
	WISER	0.1422	0.0783	0.0480	0.1980	0.1211	0.0941
	SPOT-plugin	0.3199	0.1241	0.0487	0.4322	0.2017	0.1183
	SPOT-oracle	0.3233	0.1312	0.0618	0.4355	0.2084	0.1341
Random insertion	AOL	0.0226	0.0296	0.0246	0.0294	0.0424	0.0455

Table 1: Average IoU and TPR across edit levels at different generation temperatures. For each metric, the tuning parameter is selected separately within the highest nonempty

0.01

-wide empirical-FPR bin not exceeding

0.05

. For random edits, entries are averaged over edit rates

\{0.10,0.15,0.20,0.25,0.30,0.35,0.40\}

. For adversarial edits, entries are averaged over edit budgets

K\in\{40,45,50,55,60\}

. For block permutation, entries are averaged over block sizes

b\in\{4,6,8\}

. Bold marks the largest value among the four methods for each edit type, temperature, and metric.

	Time (ms)
Edit type	AOL	WISER	SPOT-plugin	SPOT-oracle
Random substitution	168.9	152.7	157.8	152.3
Random insertion	168.8	152.7	157.8	152.4
Random deletion	85.2	76.4	82.1	76.1
Adversarial edits	168.3	152.3	157.1	151.7
Block permutation	167.2	151.6	156.8	151.3

Table 2: Mean runtime in milliseconds per document at

T=1

, using the IoU-selected configuration at empirical FPR target

0.05

. Times include pivot recomputation, localization, and shared preparation/calibration amortized over

1000

documents. They exclude parameter search, data loading, and output writing. The final row weights the five edit types equally. Bold marks the shortest time in each row.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 9: Empirical discovery phase-transition slices for SPOT with

\alpha\in\{0,0.25\}

. Each panel reports the smallest discovery error in ( 11 ) over a calibration grid along one slice, averaged over

200

trials. The vertical dashed lines show the theoretical discovery boundary.

Edit type	$T=1$	$T=0.7$	$T=0.5$
Random substitution	0.3143	0.9078	2.6951
Random insertion	0.2537	0.6942	1.9082
Random deletion	0.2975	0.7691	2.7192
Adversarial edits	0.1681	0.3031	0.9916
Block permutation	0.1343	0.3691	1.3576

Appendix

Table 3: Relative RMSE of the plug-in surviving-fraction estimator, computed as in ( 44 ) at each edit level and averaged equally over the same levels as Table 1 . Values are ratios, not percentages. Smaller is better.

Figure 10: Localization performance under three random edit mechanisms at temperature

T=1

, measured by TPR. Columns correspond to target FPR levels

0.03

0.06

, and

0.09

from left to right. Rows correspond to substitution, insertion, and deletion edits from top to bottom. Each panel reports the mean TPR as a function of the edit fraction.

Figure 11: Localization performance under three random edit mechanisms at temperature

T=1

, measured by IoU. Columns correspond to target FPR levels

0.03

0.06

, and

0.09

from left to right. Rows correspond to substitution, insertion, and deletion edits from top to bottom. Each panel reports the mean IoU as a function of the edit fraction.

Figure 12: Localization performance under three random edit mechanisms at temperature

T=0.7

, measured by TPR. Columns correspond to target FPR levels

0.03

0.06

, and

0.09

from left to right. Rows correspond to substitution, insertion, and deletion edits from top to bottom. Each panel reports the mean TPR as a function of the edit fraction.

Figure 13: Localization performance under three random edit mechanisms at temperature

T=0.7

, measured by IoU. Columns correspond to target FPR levels

0.03

0.06

, and

0.09

from left to right. Rows correspond to substitution, insertion, and deletion edits from top to bottom. Each panel reports the mean IoU as a function of the edit fraction.

Edit type	Method	IoU			TPR
Edit type	Method	$T=1$	$T=0.7$	$T=0.5$	$T=1$	$T=0.7$	$T=0.5$
Random substitution	AOL	0.0160	0.0216	0.0170	0.0215	0.0336	0.0347
	WISER	0.1243	0.0707	0.0435	0.1679	0.1042	0.0800
	SPOT-plugin	0.3083	0.1161	0.0455	0.4004	0.1787	0.1018
	SPOT-oracle	0.3121	0.1217	0.0570	0.4051	0.1840	0.1154
Random insertion	AOL	0.0184	0.0246	0.0206	0.0231	0.0337	0.0364

Appendix

Table 4: Average IoU and TPR at empirical FPR target

0.04

for three generation temperatures. Each metric is selected separately in the highest occupied

0.01

-wide FPR bin at or below the target. Entries equally average the seven random-edit rates

0.10,0.15,\ldots,0.40

, adversarial budgets

K\in\{40,45,50,55,60\}

, or permutation block sizes

b\in\{4,6,8\}

. Bold marks the largest value among the four methods for each edit type, temperature, and metric.

Edit type	Method	IoU			TPR
Edit type	Method	$T=1$	$T=0.7$	$T=0.5$	$T=1$	$T=0.7$	$T=0.5$
Random substitution	AOL	0.0269	0.0338	0.0271	0.0405	0.0599	0.0644
	WISER	0.1745	0.0900	0.0528	0.2544	0.1501	0.1178
	SPOT-plugin	0.3330	0.1375	0.0543	0.4827	0.2435	0.1493
	SPOT-oracle	0.3368	0.1456	0.0683	0.4862	0.2528	0.1681
Random insertion	AOL	0.0313	0.0396	0.0324	0.0435	0.0610	0.0648

Appendix

Table 5: Average IoU and TPR at empirical FPR target

0.07

for three generation temperatures. Each metric is selected separately in the highest occupied

0.01

-wide FPR bin at or below the target. Entries equally average the seven random-edit rates

0.10,0.15,\ldots,0.40

, adversarial budgets

K\in\{40,45,50,55,60\}

, or permutation block sizes

b\in\{4,6,8\}

. Bold marks the largest value among the four methods for each edit type, temperature, and metric.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 107 papers

Fast segmentation of watermarked texts from large language models through an epidemic change-point framework
Sep 25, 2025Soham Bonnerjee, Subhrajyoty Roy, Sayar KarmakarText Watermarking LLM Watermarking
University of Chicago · Washington University in St. Louis · University of Florida
Optimal Estimation of Watermark Proportions in Hybrid AI-Human Texts
Jun 27, 2025Xiang Li, Garrett Wen, Weiqing He +3Text Watermarking Minimax Estimation
University of Pennsylvania · Yale University
Signature filtering: a lightweight enhancement for statistical watermark detection in large language models
Jun 16, 2026Chih-Duo Hong, Yen-Pang Chen, Fang YuLLM Watermarking Robust Watermarking
National Chengchi University, Taipei, Taiwan

Sep 25, 2025J/K move · Enter open · S save

Fast segmentation of watermarked texts from large language models through an epidemic change-point framework

Soham Bonnerjee, Subhrajyoty Roy, Sayar Karmakar

University of Chicago · Washington University in St. Louis · University of Florida

Text Watermarking LLM Watermarking

Open paper AskPDF arXiv

With the growing use of large language models, concerns over content authenticity have spurred a variety of watermarking schemes. These schemes use secret keys to detect machine-generated text while remaining imperceptible to readers. Detection typically reduces to statistical hypothesis testing for the presence of watermarks, a topic that is now well studied. In contrast, the finer-grained task of localizing which segments of a text are watermarked is much less explored; existing approaches often lack scalability or guarantees robust to paraphrasing and post-editing. We bring a new perspective to this segmentation problem through the lens of epidemic change-points and, by exploiting this connection, propose WISER, a novel and computationally efficient watermark segmentation algorithm. We establish finite-sample error bounds and consistency for detecting multiple watermarked segments in a single text. Complementing these theoretical results, our extensive numerical experiments show that WISER outperforms state-of-the-art baseline methods, both in terms of computational speed as well as accuracy, on various benchmark datasets embedded with diverse watermarking schemes. Together, these theoretical and empirical results position WISER as an effective tool for watermark localization and illustrate how classical statistical ideas can yield theoretically valid and computationally efficient solutions to a modern problem of immediate importance.

Abstract

LLM Watermarking

Explore similar work

Fast segmentation of watermarked texts from large language models through an epidemic change-point framework

Optimal Estimation of Watermark Proportions in Hybrid AI-Human Texts

Signature filtering: a lightweight enhancement for statistical watermark detection in large language models