WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreading

Gang-Hyun Park; Ju-Hyeong Lee; Hee-Youl Kwak; Dae-Young Yun

cs.CRSep 2, 2026

WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreading

Authors: Gang-Hyun Park, Ju-Hyeong Lee, Hee-Youl Kwak, Dae-Young Yun

Organizations: University of Ulsan, Ulsan, Republic of Korea

Abstract

Multi-bit watermarking for large language models enables content source tracing by embedding user-identifiable messages into generated text. Existing methods face a fundamental trade-off among extraction accuracy, text quality, and payload capacity. We propose WeaveMark, a robust and scalable multi-bit LLM watermarking scheme based on coded payload spreading. WeaveMark shifts this trade-off frontier by improving payload capacity through multi-bit-per-token spreading (weaving), improving extraction accuracy through soft-decision error-correcting codes, and preserving text quality through unbiased multilayer reweighting. It further introduces dedicated zero-bit layers for reliable watermark presence detection. Extensive experiments demonstrate substantial gains in extraction performance, especially for long messages and edited text, without degrading text quality. WeaveMark achieves an 89.8% match rate for 32-bit messages at 200 tokens, compared with 20.8% for BiMark. Under 10% substitution attacks on 16-bit messages at 200 tokens, it maintains 86.0% versus 30.7%. Code is available at https://anonymous.4open.science/r/WeaveMark-ED6F.

Figures & tables

Figure 1: Conceptual comparison of representative multi-bit LLM watermarking methods. Each column represents a distinct scheme. Colors denote vocabulary partitions, $+$ / $-$ signs indicate reweighting directions, and hatched bits denote ECC codeword bits. WeaveMark weaves multiple codeword bits into each token across layers and uses soft-decision ECC decoding.

Method	Extraction accuracy ∗	Text quality †	Payload capacity ⋄
MPAC ( $\delta{=}3.0$ )	60.5	26.5	< 12
RSBH ( $\delta{=}3.0$ )	83.5	27.5	24
BiMark	83.0	30.3	16
WeaveMark	96.6	30.5	> 32

Table 1: Multi-bit watermarking comparison

Method	Multi-bit	Shuffling	Soft ECC	Bit accuracy (%)	Match rate (%)
BiMark (Baseline)	–	–	–	93.21	20.78
+ Multi-bit embedding	✓	–	–	94.52	24.00
+ Layer shuffling	✓	✓	–	96.67	55.88
+ Soft ECC ( WeaveMark )	✓	✓	✓	90.51	89.84
BiMark + Soft ECC	–	–	✓	79.78	80.59

Table 2: Component ablation for 32-bit messages with 200 generated tokens.

	Summarization				Translation
Method	BERTScore	R-1	R-2	R-L	BERTScore	BLEU
No watermark	30.54	41.15	19.17	28.63	94.95	25.24
WeaveMark	30.48	40.89	18.22	28.11	94.52	23.15
BiMark	30.27	40.70	18.28	28.00	94.56	23.22
MPAC ( $\delta=2.0$ )	29.81	39.75	16.87	26.97	94.39	21.47
MPAC ( $\delta=3.0$ )	26.53	36.61	12.87	23.60	93.50	16.78

Table 3: Text quality on downstream tasks. Higher values indicate better quality.

Method	16-bit	32-bit
WeaveMark	2.24	2.33
BiMark	4.54	5.55

Table 4:

z

-score threshold at FPR=1% averaged over 25 to 200 tokens.

Method	50	75	100	125	150	175	200
WeaveMark	97.94	98.53	98.67	98.45	98.81	98.99	98.95
EXP-edit	99.40	99.60	99.63	99.53	99.77	99.80	99.93
SynthID	98.09	98.41	98.61	98.68	98.92	99.08	99.26
KGW ( $\delta=2.0$ )	92.98	96.74	97.49	97.67	98.10	98.61	99.13
DiPmark ( $\alpha=0.45$ )	46.43	72.21	78.29	85.61	88.46	89.70	91.60

Table 5: Pure zero-bit detection TPR (%) at FPR=1%. Columns give the number of generated tokens.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

	12-bit			16-bit			32-bit			48-bit			64-bit
Method	100	150	200	100	150	200	100	150	200	200	400	500	200	400	500
WeaveMark	97.7	98.8	99.1	92.8	97.9	99.0	48.0	76.3	89.4	57.8	92.8	96.9	25.6	78.7	89.3
BiMark	62.6	83.3	92.6	35.8	61.7	77.5	0.2	3.2	11.1	0.1	13.9	27.8	0.0	1.0	5.3
RSBH	48.2	75.3	86.1	28.3	56.1	73.9	0.6	5.6	17.1	0.3	23.2	42.8	0.0	5.3	16.7
MPAC	58.5	77.1	87.4	28.7	48.3	66.1	0.3	3.0	7.3	0.3	7.0	14.0	0.0	0.9	2.2
XMark	41.7	63.3	76.8	18.4	38.0	54.1	0.1	1.4	3.4	0.1	3.0	8.8	0.0	0.2	0.7

Appendix

Table 6: Match rate (%) from 12- to 64-bit payloads. Column groups give the payload length and the columns within each group give the number of generated tokens.

	Mistral-7B		Qwen2.5-7B
Method	Clean	$\rho{=}0.1$	Clean	$\rho{=}0.1$
WeaveMark	99.0	81.8	99.1	84.3
BiMark	77.5	25.0	83.0	29.4
RSBH	73.9	19.6	65.3	20.0
MPAC	66.1	23.8	68.4	25.1
XMark	54.1	11.6	57.1	13.5

Appendix

Table 7: Match rate (%) across model families, for 16-bit messages with 200 generated tokens. Substitution uses a ratio of

\rho=0.1

.

Method	$\rho{=}0.1$	$\rho{=}0.2$	$\rho{=}0.3$	$\rho{=}0.1$	$\rho{=}0.2$	$\rho{=}0.3$
	24-bit			32-bit
WeaveMark	60.13	14.41	0.72	32.10	2.72	0
BiMark	4.95	0.24	0	0.68	0.06	0
MPAC ( $\delta{=}2.0$ )	0.59	0.11	0	0	0	0
MPAC ( $\delta{=}3.0$ )	4.56	0.80	0.15	0.49	0.05	0
RSBH ( $\delta{=}2.0$ )	11.18	1.68	0.26	2.38	0.30	0

Appendix

Table 8: Match rate (%) at 200 tokens for 24-bit and 32-bit messages across substitution ratios.

		Insertion			Deletion			Mixed
Method	Clean	10%	15%	20%	10%	15%	20%	10%	15%	20%
WeaveMark	99.0	96.2	91.6	84.5	94.7	88.5	73.0	94.1	87.2	77.4
BiMark	77.5	48.7	36.3	26.2	44.5	27.5	14.4	45.6	28.9	19.8
RSBH	73.9	40.0	27.0	16.8	36.1	21.9	10.2	37.1	20.0	12.6
MPAC	66.1	43.0	30.6	23.1	40.9	25.8	15.5	38.5	26.9	17.0
XMark	54.1	25.5	16.1	9.9	23.9	11.3	6.6	23.1	12.5	7.7

Appendix

Table 9: Match rate (%) under position-changing edits, for 16-bit messages with 200 generated tokens. Mixed edits apply insertion, deletion, and substitution at equal rates.

	Truncation		Copy-paste
Method	10%	20%	10%	15%	20%
WeaveMark	98.7	98.4	98.1	97.2	95.7
BiMark	71.9	65.6	66.0	56.6	49.8
RSBH	68.0	60.1	60.4	53.7	42.8
MPAC	59.4	52.9	56.1	49.9	42.8
XMark	48.5	41.6	40.5	34.3	28.7

Appendix

Table 10: Match rate (%) under attacks that preserve contiguous spans (truncation and copy-paste), for 16-bit messages with 200 generated tokens.

	Summarization			Round-trip
Method	r30	r50	r70	(en,fr,en)
WeaveMark	61.5	80.3	84.9	36.6
BiMark	7.5	21.0	35.3	3.4
RSBH	6.7	16.8	28.5	2.0
MPAC	9.9	19.8	28.8	4.0
XMark	4.5	10.1	18.2	2.0

Appendix

Table 11: Match rate (%) under summarization and round-trip translation, for 16-bit messages with 200 generated tokens. Summarization ratios r30, r50, and r70 denote the fraction of the original length retained.

	(L=20, O=0)		(L=0, O=20)		(L=20, O=20)
Method	Bit	Match	Bit	Match	Bit	Match
WeaveMark	80.78	59.10	89.43	86.94	78.18	49.02
BiMark	84.33	13.49	92.29	42.17	81.80	9.80
MPAC ( $\delta{=}2.0$ )	75.25	3.56	81.41	9.93	73.70	2.44
MPAC ( $\delta{=}3.0$ )	82.89	12.98	89.33	31.98	80.84	9.67
RSBH ( $\delta{=}2.0$ )	71.43	12.61	80.63	36.47	69.60	9.96

Appendix

Table 12: Robustness under DIPPER paraphrasing (16-bit, 200 tokens). (L, O) denotes lexical and order diversity. Bit/Match: bit accuracy and match rate (%).

	$h=2$	$h=3$	$h=4$
Valid embedding ratio	86.6	94.0	97.2
Clean text	99.0	99.2	99.1
Subst. (10%)	81.8	74.6	59.3
Subst. (20%)	40.7	21.4	9.9
Ins. (10%)	96.2	94.6	89.7
Ins. (20%)	84.5	69.7	47.5

Appendix

Table 13: Effect of the context window size

h

on the valid embedding ratio and match rate (%), for 16-bit messages with 200 generated tokens on Mistral-7B with OpenGen. Left: scattered edits, whose impact increases with

h

. Right: attacks that preserve contiguous spans, which are largely insensitive to

h

, together with summarization.

Setting	Mean	Std. dev.	95% CI
16-bit, 200 tokens	98.98	0.200	[98.83, 99.12]
32-bit, 200 tokens	88.49	0.660	[88.02, 88.96]

Appendix

Table 14: Match rate (%) across ten replications with independently resampled prompts, messages, and secret keys, in the setting of Appendix B . Confidence intervals are

t

-based over the ten replications.

Method	50	75	100	125	150	175	200	Avg.
WeaveMark	0.989	0.981	0.989	1.003	0.981	0.992	0.976	0.987
EXP-edit	0.961	0.987	1.003	0.977	0.969	0.982	0.983	0.980
SynthID	0.986	0.997	1.002	0.992	0.998	1.000	0.987	0.995
KGW ( $\delta=2.0$ )	0.764	0.883	0.792	0.655	0.876	0.775	0.895	0.806
DiPmark ( $\alpha=0.45$ )	0.789	0.903	0.720	0.854	0.911	0.827	0.888	0.842

Appendix

Table 15: Held-out FPR (%), averaged over 200 random splits in which the threshold is computed on one half of the non-watermarked texts and evaluated on the other half. Columns give the number of generated tokens.

Method	Threshold	50	75	100	125	150	175	200	Avg.
WeaveMark	Selected	97.94	98.53	98.67	98.45	98.81	98.99	98.95	98.62
WeaveMark	Interpolated	97.95	98.53	98.67	98.45	98.81	98.99	98.95	98.62
EXP-edit	Selected	99.40	99.60	99.63	99.53	99.77	99.80	99.93	99.67
EXP-edit	Interpolated	99.40	99.61	99.63	99.53	99.77	99.83	99.93	99.67
SynthID	Selected	98.09	98.41	98.61	98.68	98.92	99.08	99.26	98.72
SynthID	Interpolated	98.09	98.41	98.61	98.68	98.92	99.08	99.26	98.72

Appendix

Table 16: Clean zero-bit TPR (%) under the selected threshold and under interpolation to an expected empirical FPR of 1% on the calibration set. The selected rows are the values reported in Table 5 . Columns give the number of generated tokens.