A Trustworthy Watermarking Framework for LLM-Generated Food Safety Content

Zhongli Fang; Yiran Chen; Lingyun Zhang; Yu Liu; Ping Chen; Xiaoyan Sun; Jun Dai

cs.CRSep 6, 2026

A Trustworthy Watermarking Framework for LLM-Generated Food Safety Content

Authors: Zhongli Fang, Yiran Chen, Lingyun Zhang, Yu Liu, Ping Chen, Xiaoyan Sun, Jun Dai

Organizations: School of Computer Science and Technology, Fudan University, China · Institute of Big Data, Fudan University, China · Worcester Polytechnic Institute

Abstract

Large language models are transforming many industries with their text generation abilities. However, their outputs can be easily tampered with, creating serious risks in critical areas such as food safety reporting. To protect the integrity and traceability of AI-generated content, this paper introduces ToSS (Token Oriented Repartitioning and Strategic Selection), a reliable authentication method using adaptive dual watermarking. The key innovation of ToSS is its dual watermark encoding approach that divides vocabulary tokens into black and white sublists, enabling precise bit-level embedding of traceability information. Additionally, an entropy adaptive mechanism dynamically selects text regions with high prediction uncertainty for watermark insertion, maintaining text fluency and factual accuracy while ensuring reliable traceability. Experiments on multiple datasets, including food domain texts, demonstrate that ToSS achieves leading performance in both watermark capacity and decoding accuracy.

Figures & tables

Fig. 1: Illustration of watermark extraction in the ToSS framework. The first-stage watermark verifies existence using red and green token lists, while the second-stage watermark encodes multi-bit traceability information through black (orange) and white (blue) token lists. The extracted bit sequence is compared with the stored reference to determine whether the text is authentic or tampered.

Fig. 2: Overview of the ToSS framework. Given an input prompt, the language model generates text while the entropy-based filtering module identifies high-entropy and low-entropy regions. Multi-bit watermark information is embedded only in high-entropy regions via dynamic black–white list selection, while low-entropy regions are preserved to maintain textual fluency and factual accuracy.

Method	12-bit			16-bit			20-bit			24-bit			32-bit
	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)
Fernandez et al. [ 7 ]	99.6	100.0	0.12	99.6	100.0	0.34	99.2	99.9	5.04	98.0	99.8	110	NA	NA	29000 (Estimated)
Wang et al. [ 21 ]	99.6	100.0	0.16	98.8	99.9	0.58	98.4	99.8	3.14	97.2	99.6	35.5	NA	NA	8300 (Estimated)
Yoo et al. [ 22 ]	86.4	96.5	0.01	73.6	94.6	0.01	49.2	90.8	0.01	30.4	89.4	0.01	8.4	81.2	0.01
Cohen et al. [ 4 ]	93.2	98.7	0.01	88.8	97.0	0.02	78.4	95.3	0.02	65.6	94.7	0.03	27.2	89.7	0.04
Qu et al. [ 16 ]	98.8	99.9	0.04	98.0	99.7	0.06	97.6	99.6	0.10	96.0	99.5	0.18	94.0	99.1	0.6

TABLE I: Comparison of watermarking performance across representative methods under different bit lengths.

Fig. 3: Match rate performance of the proposed ToSS method across different large language models and datasets.

Fig. 4: Z-score performance of the ToSS watermark across different large language models and datasets.

Threshold	12-bit			16-bit			20-bit			24-bit			32-bit			64-bit
	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)	Match (%)	Bit Acc (%)	Time (s)
0.0	100.0	100.0	0.12	100.0	100.0	0.17	100.0	100.0	0.18	100.0	100.0	0.19	100.0	100.0	0.21	100.0	100.0	0.28
1.0	100.0	100.0	0.35	99.45	99.93	0.36	99.43	99.89	0.36	98.95	99.79	0.37	98.95	99.65	0.39	95.63	99.12	0.47
2.0	98.00	99.85	0.37	97.00	99.75	0.40	95.88	99.62	0.43	94.40	99.49	0.47	92.50	99.32	0.51	89.38	99.10	0.64
3.0	98.0	98.0	0.36	88.0	93.3	0.37	90.0	90.0	0.42	84.0	86.4	0.42	66.0	72.4	0.46	16.0	17.4	0.47
4.0	74.0	75.2	0.44	58.0	59.6	0.45	44.0	46.4	0.46	40.0	40.0	0.47	16.0	16.0	0.47	0.0	0.0	0.49

TABLE II: Performance of the LLaMA‑2‑7B model on the OpenGen dataset under different entropy thresholds

Threshold	12-bit	16-bit	20-bit	24-bit	32-bit	64-bit
0.0	4.82	5.26	4.88	5.11	6.41	9.99
1.0	4.32	4.29	4.52	4.53	5.20	7.14
2.0	4.48	4.54	4.62	4.73	4.89	5.31
3.0	4.00	3.90	3.74	4.02	3.81	4.28
4.0	3.80	3.87	3.90	4.00	3.77	3.84

TABLE III: Effect of different entropy thresholds on text perplexity (PPL) of the LLaMA‑2‑7B model on the OpenGen dataset

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks
Aug 13, 2026Xiaoyan Feng, Yanjun Zhang, He Zhang +2Data Provenance LLM Watermarking
Griffith University
TripPattern: A Pattern-based Text Watermarking Method for Large Language Models
Sep 11, 2026Sangjun Moon, Dasom Choi, Jingun Kwon +3Text Watermarking LLM Watermarking
Chungnam National University · Nara Institute of Science and Technology (NAIST) · Institute of Science Tokyo
Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection
May 22, 2026Kieu Dang, Phung Lai, NhatHai Phan +2Text Watermarking Language Model Fingerprinting
State University of New York at Albany · New Jersey Institute of Technology · Microsoft +1

Aug 13, 2026J/K move · Enter open · S save

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

Xiaoyan Feng, Yanjun Zhang, He Zhang, Leo Yu Zhang+1

Griffith University

Data Provenance LLM Watermarking Robust Watermarking Robustness of Machine-Generated Text Detection

Open paper AskPDF arXiv

Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits.

Abstract

LLM Watermarking

Explore similar work

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

TripPattern: A Pattern-based Text Watermarking Method for Large Language Models

Robust LLM Watermarking with Minimal Semantic Distortion for IP Protection