TANGO: Watermarking Masked Diffusion Language Models in Token Pairs

Kasra Arabi; Nir Weinberger; Micah Goldblum; Niv Cohen

cs.LGSep 28, 2026

TANGO: Watermarking Masked Diffusion Language Models in Token Pairs

Authors: Kasra Arabi, Nir Weinberger, Micah Goldblum, Niv Cohen

Abstract

Masked-diffusion language models fill in masked positions in parallel and in no fixed order. Most practical text watermarks assume left-to-right generation. They key each token to the tokens before it, and in a diffusion model those tokens may still be masked. A fixed green list needs no such context, but it favors the same tokens at every position, so these tokens appear more often in watermarked text. An attacker who compares token frequencies in watermarked and unwatermarked text can recover the list and forge text that the provider's own detector accepts. We present TANGO, a watermark for masked-diffusion language models that keys each new token to a nearby token that is already unmasked. A secret key splits the vocabulary into color classes, and TANGO biases the new token toward a color determined by the key and the nearby token's color. The watermark is therefore embedded in pairs of tokens. Because the favored color changes from position to position, token frequencies stay much closer to those of unwatermarked text than under a fixed green list. Detection needs only the text and the key, and it does not assume any unmasking order. On two masked-diffusion models, TANGO detects nearly all unedited watermarked texts and most edited ones, and frequency attacks that forge the fixed green list fail against it.

Figures & tables

			TPR@1%FPR
model	method	AUROC	clean	del30	syn30	ins20	PPL
LLaDA	TANGO	0.998	$0.97^{\pm 0.02}$	$0.68^{\pm 0.07}$	$0.92^{\pm 0.04}$	$0.91^{\pm 0.04}$	7.2
LLaDA	Red–green list	0.993	$0.98^{\pm 0.02}$	$0.96^{\pm 0.02}$	$0.94^{\pm 0.03}$	$0.98^{\pm 0.02}$	7.6
LLaDA	Gumbel	0.815	$0.15^{\pm 0.05}$	$0.10^{\pm 0.04}$	$0.07^{\pm 0.04}$	$0.07^{\pm 0.04}$	4.6
LLaDA	unwatermarked	–	–	–	–	–	4.2
Dream	TANGO	1.000	$1.00^{\pm 0.00}$	$0.73^{\pm 0.08}$	$0.98^{\pm 0.03}$	$0.97^{\pm 0.03}$	7.8

Table 1: TANGO detects nearly all unedited and most edited watermarked texts at a perplexity close to the red–green list’s. TPR@1%FPR under no attack (clean) and under the three edits, with the half-width of a

95\%

bootstrap interval as superscript. TANGO at the default setting, red–green list with green fraction

0.25

and bias

5

, Gumbel rule at temperature

\tau=1.0

n=200

per method on LLaDA and

100

on Dream, with the unwatermarked continuations of the same prompts as negatives. PPL is Qwen2.5-7B-Instruct perplexity over non-degenerate continuations ( Appendix B ).

			TPR@1%FPR
axis	setting	AUROC	clean	del30	syn30	ins20	PPL	null FPR (%)
colors $q$	$2$	0.989	0.92	0.62	0.71	0.83	20.4	0.0
	$\mathbf{3}$	1.000	1.00	0.92	0.96	1.00	22.2	0.0
	$4$	1.000	1.00	0.79	0.83	0.96	26.8	0.5
	$8$	1.000	1.00	0.83	0.83	1.00	29.9	0.5
	$16$	0.998	0.96	0.88	0.96	0.96	29.5	0.0

Table 2: Three colors and a single tap detect best under edits. LLaDA-8B, one-sided enforcement at

\beta=8

n=24

per row, defaults in bold. The

q

rows use lag

1

(and, for

q\geq 4

, the key’s residue), and the tap rows use

q=3

, so they are separate runs. PPL is GPT-2-large perplexity, and null FPR is the fraction of

200

natural C4 texts with

z>4

. The residue ablation is in Section C.3 .

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

result	claim in words	assumes	appendix
Proposition 1	Unwatermarked text gives a $\mathrm{Binom}(T,1/q)$ count.	uniform colors, (I)	A.2
Proposition 3	A uniformly random balanced coloring gives every class mass close to $1/q$ unless the context is peaked.	hash coloring	A.2
Proposition 2	The expected score is $\sqrt{T}\,\varepsilon/\sigma_{0}$ .	definitions only, fixed $T$	A.3
Corollary 1	The expected score reaches $z_{\star}$ once $T\geq T_{\star}=z_{\star}^{2}\sigma_{0}^{2}/\varepsilon^{2}$ .	$z_{\star}>0$ , constant $\varepsilon>0$	A.3
Lemma 1 †	Unenforced pairs match at the chance rate, so $\varepsilon=\kappa\,\bar{\varepsilon}_{\mathrm{enf}}$ .	(S), (U ′ ), (B), single tap, $\gcd(a_{\delta},q)=1$	A.3
Corollary 2	The false-negative rate decays exponentially in $T$ .	(I)	A.4

Appendix

Table 3: The formal results, what each says, and what each assumes. The assumptions (S), (U), (U ′ ), (B), and (I) are stated in Section A.1 . Results marked † also treat a committed token as a draw from its candidate distribution, the second part of (S).

symbol	meaning
$\mathcal{V}$ , $V$	vocabulary and its size, $V=\|\mathcal{V}\|$
$t_{1},\dots,t_{L}$	tokens of a text of length $L$
$x^{(j)}$	state after $j$ denoising steps, the partly unmasked sequence
$q$ , $\mathbb{Z}_{q}$	number of colors, and $\{0,\dots,q-1\}$ with arithmetic modulo $q$
$\chi$	balanced coloring $\mathcal{V}\to\mathbb{Z}_{q}$ fixed by the key; class $s$ has $n_{s}\in\{\lfloor V/q\rfloor,\lceil V/q\rceil\}$ tokens
$\mathcal{D}$ , $\delta$ , $a_{\delta}$	set of tap lags, one lag, and its coefficient in $\mathbb{Z}_{q}\setminus\{0\}$

Appendix

Table 4: Notation used in the proofs.

coloring	null source	mean $z$	std	KS	FPR $z{>}4$
unwhitened	natural	$1.07$	1.10	0.403	1.00%
unwhitened	random tokens	$0.02$	1.04	0.047	0.00%
ZCA	natural	$0.67$	1.17	0.274	0.33%
ZCA	random tokens	$-0.05$	1.00	0.057	0.00%

Appendix

Table 5: Whitening lowers the score of unwatermarked natural text on Dream, and random-token text stays calibrated with or without it.

300

texts per row. KS is the Kolmogorov–Smirnov distance to

\mathcal{N}(0,1)

text	lag	class mass ( $0/1/2$ )	null rate ( $b=0/1/2$ )	null mean $z$ ( $b=0/1/2$ )
natural	1	$0.317/0.291/0.392$	$0.302/0.366/0.332$	$-0.93/{+0.98}/{-0.05}$
natural	2	$0.317/0.291/0.392$	$0.319/0.341/0.340$	$-0.42/{+0.24}/{+0.19}$
model	1	$0.326/0.263/0.411$	$0.298/0.362/0.340$	$-0.83/{+0.68}/{+0.15}$
model	2	$0.326/0.263/0.411$	$0.303/0.358/0.339$	$-0.71/{+0.58}/{+0.13}$

Appendix

Table 6: Unwatermarked text satisfies each residue at a different rate under the default coloring (

q=3

). Class mass is the fraction of the text’s tokens in each color class, an estimate of the average of

m_{s}

over positions. The token counts of the classes differ by at most one. Null rate is the fraction of scored positions whose color pair satisfies the checksum for residue

b

(chance

1/3

). Null mean

z

is the mean detector score per text. Natural is

2000

C4 texts, and model is the

200

unwatermarked LLaDA continuations of Table 1 .

residue	AUROC	clean	mean $z$	null mean $z$	del30	syn30	ins20	PPL GPT-2
$b=0$	1.000	1.00	6.33	$-0.46$	0.79	0.92	0.93	27.6
$b=1$	0.999	0.97	6.59	$+0.24$	0.32	0.58	0.68	26.1
$b=2$	1.000	1.00	6.80	$+0.22$	0.76	0.98	0.99	25.2
tap-keyed	0.991	0.97	6.02	$-0.93$	0.91	0.93	0.97	26.9

Appendix

Table 7: The residues differ in the null score more than in the watermarked score. LLaDA, lag

2

a_{2}=1

, one-sided enforcement at

\beta=8

n=100

. The clean and attack columns are TPR@1%FPR with the

100

unwatermarked continuations of the same prompts as negatives. Mean

z

is the mean score of unedited watermarked text, and null mean

z

the mean score of

500

natural texts (the first

500

of the

2000

texts of Table 6 ). Tap-keyed sets the residue by a keyed hash of the tap color.

method	frequency shift (TV)	key recovery AUC	forgery success
TANGO	0.217	0.504	0.00
Red–green list	0.340	0.817	1.00

Appendix

Table 8: Token frequencies reveal the red–green list’s key but not TANGO’s.

200

texts per method, TANGO with one-sided enforcement at

\beta=8

, red–green list at bias

5

. Frequency shift is the total-variation distance between watermarked and unwatermarked token frequencies (sampling noise alone gives

0.210

). Key recovery is the AUC of predicting the coloring from per-token frequency shifts. Forgery success is the fraction of texts generated from the predicted key that the detector accepts at

z>4

model	method	$N=25$	$N=50$	$N=100$	$N=200$
LLaDA	TANGO	0.62 / 0.12	0.62 / 0.18	0.62 / 0.48	0.62 / 0.74
LLaDA	Red–green list	0.63 / 0.51	0.64 / 0.74	0.65 / 0.89	0.66 / 0.96
LLaDA	Gumbel	0.53 / 0.17	0.54 / 0.25	0.53 / 0.24	0.53 / 0.56
LLaDA	DLM watermark, defaults	0.54 / –	0.55 / –	0.54 / –	0.54 / –
LLaDA	DLM watermark, matched, bias $2$	0.53 / –	0.53 / –	0.55 / –	0.55 / –
LLaDA	DLM watermark, matched, bias $3$	0.55 / –	0.55 / –	0.56 / –	0.57 / –

Appendix

Table 9: Forgeries built from token-pair counts pass TANGO’s detector less often than the red–green list’s at every

N

. Each cell is pair AUC / forgery success , averaged over five random subsets of the

N

texts the attacker holds. Pair AUC uses each method’s tap lag (

2

for TANGO,

1

otherwise). Forgery success is the fraction of

50

forged

128

-token texts accepted at

z>4

. TANGO uses the either-side texts of Table 1 . A dash (–) marks dgMARK’s pair AUC, which its keyless test leaves undefined ( Section D.3 ), and forgeries we did not score, because the DLM watermark and KGW detectors run in their own code base. Dream has

100

texts per method, so it has no

N=200

entry. KGW is the context-hashed green list of Kirchenbauer et al. (2023) , run through the DLM watermark’s code. dgMARK runs without its beam-search lookahead ( Section D.3 ).

$\beta_{\mathrm{forge}}$	detector	mean $z$	success (1% FPR)	success ( $z>4$ )	PPL GPT-2
4	TANGO	0.08	0.04	0.00	13.5
4	Red–green list	4.15	0.51	0.56	15.2
8	TANGO	2.62	0.55	0.23	21.1
8	Red–green list	10.56	0.98	0.98	30.2

Appendix

Table 10: At forging bias

\beta_{\mathrm{forge}}=4

, an attacker with the model but not the key passes TANGO’s detector in

4\%

of cases and the red–green list’s in

51\%

. The attacker mines the

200

watermarked texts of each method from Table 1 and generates on

100

unseen prompts. Against TANGO it biases each position toward the tokens that, in the collected lag-

2

pairs, followed the token two positions to its left. Against the red–green list it biases every position toward the tokens most over-represented in watermarked text. Success is at each detector’s empirical

1\%

FPR threshold on these prompts (

z=1.96

for TANGO,

4.15

for the red–green list) and at the fixed

z>4

. PPL is GPT-2-large perplexity, and unwatermarked text on these prompts has PPL

13.1

		TPR@1%FPR				PPL (control)
method	AUROC	clean	del30	syn30	ins20	Qwen	GPT-2	freq. AUC	pair AUC	forge
TANGO ( $\beta=5$ , either side)	0.998	0.97	0.68	0.92	0.91	7.0 (4.1)	18.9 (12.9)	0.50	0.62	0.74
Red–green list, bias $5$	0.993	0.98	0.96	0.94	0.98	7.4 (4.1)	17.6 (12.9)	0.82	0.66	0.96
Gumbel rule	0.815	0.15	0.10	0.07	0.07	4.5 (4.1)	13.6 (12.9)	–	0.53	0.56
DLM watermark, defaults (bias $2$ )	0.843	0.37	0.30	0.22	0.24	6.5 (6.1)	39.9 (71.1)	–	0.54	–
DLM watermark, matched, bias $2$	0.808	0.19	0.16	0.09	0.09	4.2 (4.0)	24.1 (21.5)	–	0.55	–

Appendix

Table 11: Neither of the two published diffusion watermarks we ran detects more than TANGO or the red–green list at a similar perplexity increase over its own control.

200

C4 prompts,

128

tokens, LLaDA-8B. TANGO, the red–green list, and the Gumbel rule are at the settings of Table 1 . The published diffusion watermarks were run from their public code at their own default decoding settings and at our decoding settings ( matched ), dgMARK without its beam-search lookahead. The DLM watermark’s default run and both dgMARK runs, with their controls, decode in

32

-token blocks, and all other runs decode the

128

tokens as one block. A dash marks a value that is undefined or that we did not compute, namely frequency AUC for the Gumbel rule, the DLM watermark, and KGW, pair AUC for dgMARK’s keyless test, and forgery success for the DLM watermark and KGW, whose forgeries we did not score. Each perplexity is followed, in parentheses, by that of unwatermarked text from the same sampler, and both are over all continuations. Freq. AUC is key recovery from token frequencies ( Table 8 ). Pair AUC and forge are at

N=200

from Table 9 , where KGW is also defined. In the DLM watermark’s default row,

2

3

of the

200

texts per column received no score from its detector and are left out.

setting	AUROC	clean	del30	syn30	ins20	PPL GPT-2	PPL Qwen
TANGO $\beta=4$	0.998	0.97	0.61	0.84	0.85	16.8	6.1
TANGO $\beta=5$ ( Table 1 )	0.998	0.97	0.68	0.92	0.91	19.4	7.2
TANGO $\beta=6$	0.999	0.99	0.81	0.95	0.96	21.3	8.4
TANGO $\beta=8$	1.000	1.00	0.93	0.99	0.98	31.4	13.5
TANGO $\beta=10$	1.000	1.00	0.97	0.98	0.99	51.8	23.4
Red–green list, bias $2$	0.940	0.58	0.38	0.39	0.69	13.5	4.6

Appendix

Table 12: The red–green list detects more deleted texts than TANGO at matched perplexity. LLaDA,

n=200

per setting, with the

200

unwatermarked continuations as negatives. TANGO (either side) varies

\beta

, the red–green list its bias, and the Gumbel rule its sampling temperature. Perplexity is over non-degenerate continuations, which are at least

94\%

of every setting ( Appendix B ). The Gumbel row at

\tau=1.0

is a second generation run of the setting in Table 1 , so it differs from that row by sampling noise.

method	AUROC	clean	del30	syn30	ins20	PPL GPT-2	degenerate
		TPR@1%FPR
TANGO ( $\beta=5$ , either side)	1.000	1.00 [1.00,1.00]	0.73 [0.65,0.81]	0.98 [0.95,1.00]	0.97 [0.93,1.00]	15.2	31%
Red–green list	1.000	1.00 [1.00,1.00]	0.98 [0.95,1.00]	0.98 [0.95,1.00]	0.98 [0.95,1.00]	18.1	62%
unwatermarked	–	–	–	–	–	9.9	20%

Appendix

Table 13: On Dream, TANGO and the red–green list detect every unedited text, and TANGO has the lower perplexity on non-degenerate continuations.

n=100

per method, unwhitened coloring, with the

100

unwatermarked continuations as negatives and

95\%

bootstrap intervals. PPL is GPT-2-large perplexity over non-degenerate continuations, and degenerate is the fraction of continuations that collapsed into a repeated phrase ( Appendix B ).

	key-aware			random
budget	mean $z$	PPL GPT-2	det. rate	mean $z$	PPL GPT-2	det. rate
10%	4.34	28.1	0.62	4.42	28.5	0.60
25%	3.11	44.3	0.27	2.81	44.2	0.20
50%	1.54	76.8	0.02	1.03	95.2	0.02

Appendix

Table 14: Knowing the key does not help this attacker remove the watermark. One-sided enforcement at

\beta=6

, whitened coloring,

n=60

, clean mean

z=5.55

. Each budget is the fraction of words regenerated. Det. rate is the fraction of texts still above

z=4

. PPL is GPT-2-large perplexity.

attack	TPR@1%FPR (95% CI)	per-seed std
clean	0.98 [0.95,1.00]	0.04
del10	0.92 [0.85,0.97]	0.08
del30	0.62 [0.52,0.72]	0.18
syn30	0.85 [0.78,0.92]	0.11
syn50	0.61 [0.51,0.71]	0.19
ins20	0.91 [0.84,0.96]	0.09

Appendix

Table 15: Detection over three generation seeds, one-sided enforcement at

\beta=8

with a single tap at lag

2

and the unwhitened coloring,

32

texts per seed, with the

96

unwatermarked continuations as negatives. Intervals are

95\%

percentile intervals from

1000

bootstrap resamples of the pooled texts, and the per-seed std is the population standard deviation over the three seeds.

quantity	mean	std
clean AUROC	0.998	0.002
mean $z$ on natural text	$-0.11$	0.28

Appendix

Table 16: Detection over four independent secret keys, one-sided enforcement at

\beta=6

, whitened coloring,

40

texts per key, with the

40

unwatermarked continuations of the same prompts as negatives. Each key uses its own residue,

b=2

0

2

, and

0

. The std is the population standard deviation over the four keys. The second row is the mean score of

300

natural C4 texts.

coloring	AUROC	clean	del10	del30	syn30	syn50	ins20	PPL GPT-2	null FPR (%)
quantile, $q=2$	0.989	0.92	0.79	0.62	0.71	0.58	0.83	20.4	0.0
quantile, $q=3$	1.000	1.00	1.00	0.92	0.96	0.75	1.00	22.2	0.0
quantile, $q=4$	1.000	1.00	0.96	0.79	0.83	0.67	0.96	26.8	0.5
quantile, $q=8$	1.000	1.00	1.00	0.83	0.83	0.62	1.00	29.9	0.5
quantile, $q=16$	0.998	0.96	0.96	0.88	0.96	0.92	0.96	29.5	0.0
cluster, $q=2$	0.817	0.38	0.25	0.12	0.17	0.08	0.46	13.3	60.0

Appendix

Table 17: The semantic-quantile coloring keeps the null FPR at or below

0.5\%

for every

q

, while the cluster coloring flags

60\%

of natural texts at

q=2

and

30.5\%

q=3

. Lag

1

n=24

per row. The residue is the default key’s,

b=0

for

q\leq 3

and

b=3

7

, and

15

for

q=4

8

, and

16

taps $\mathcal{D}$	AUROC	clean	del10	del30	syn30	syn50	ins20	PPL GPT-2
$\{1\}$	0.990	0.96	0.96	0.92	0.83	0.71	0.96	25.6
$\{2\}$	1.000	1.00	1.00	0.92	0.96	0.92	0.96	25.0
$\{1,2\}$	0.990	0.96	0.79	0.25	0.58	0.17	0.79	19.6
$\{1,3\}$	1.000	1.00	0.88	0.50	0.62	0.62	0.75	18.5
$\{1,2,3\}$	0.986	0.83	0.62	0.25	0.25	0.04	0.54	16.7
$\{1,2,3,4\}$	0.984	0.83	0.50	0.12	0.38	0.25	0.42	18.9

Appendix

Table 18: Adding taps lowers detection under edits.

q=3

semantic-quantile coloring,

n=24

per row.

setting		AUROC	clean	del30	syn30	ins20	enforced fraction	PPL GPT-2	PPL Qwen	pair AUC / forge
one-sided, $\beta=8$ (reference)		0.999	0.98	0.79	0.98	0.98	0.61	24.0	9.7	0.61 / 0.36
one-sided, $\beta=6$		0.999	0.98	0.75	0.79	0.96	0.62	19.6	7.4	0.61 / 0.26
either side, $\beta=8$	$\times$	1.000	1.00	0.94	1.00	1.00	0.74	31.1	12.7	0.62 / 0.47
either side, $\beta=6$		1.000	1.00	0.77	0.96	0.96	0.75	19.6	7.8	0.63 / 0.38
either side, $\boldsymbol{\beta=5}$	$\circ$	1.000	1.00	0.79	0.92	0.98	0.76	17.8	7.0	0.62 / 0.40
either side, $\beta=4$		0.998	0.96	0.73	0.81	0.81	0.77	16.0	5.9	0.61 / 0.23

Appendix

Table 19: Either-side enforcement at

\beta=5

(bold) has the lowest Qwen perplexity among the eligible settings of the selection experiment.

48

held-out C4 prompts, with their

48

unwatermarked continuations as negatives. Pair AUC / forge is the attack of Table 9 at

N=48

. Target, cap biases each enforced position just enough to lift the favored class to the target probability, with a bias of at most the cap. Steered is order steering.

\circ

marks eligible settings,

\times

marks eligible settings excluded for forgery, and unmarked settings are ineligible (rule in Appendix B ). Perplexity is over all continuations.

Explore similar work

Jun 3, 2026cs.CR

Global Sketch-Based Watermarking for Diffusion Language Models

Watermarking methods for language models have been studied extensively in the autoregressive setting, where tokens are generated sequentially. These works largely focus on local-context schemes that perturb the next token's distribution as a function of its preceding tokens. In diffusion language models, distributions over many unresolved positions are jointly sampled, allowing additive statistics of the entire sequence to be tractable during generation. We propose a watermark for masked diffusion language models that controls a global, vector-valued sketch representation of the text. Compared to context-dependent watermarking, the sketch formulation decouples detection from the local contexts seen during generation, resulting in an order-agnostic statistic and a watermarking rule which does not manifest as a simple token bias. We analyze the distortion, soundness, and robustness properties of the method.

Daniel Zhao

Harvard University

Watermarking Diffusion Language Models

Ask PDF

May 6, 2026cs.CL

Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks

Statistical watermarking is a common approach for verifying whether text was written by a language model. Most existing schemes assume autoregressive generation, where tokens are produced left to right and contextual hashing is well defined. Diffusion language models generate text by denoising tokens in arbitrary order, so these schemes cannot be applied directly. A recent watermark by Gloaguen et al. addresses this gap for LLaDA 8B Instruct and reports true positive detection above 99%. This paper studies what happens when watermarked text is rewritten not once but several times. Using the same watermark configuration, 1,605 watermarked completions of about 300 tokens each are produced across five WaterBench domains. Each completion is rewritten by four open weight language models, from 1.5B to 8B parameters, none of which know the watermark key. Five rewrite styles are tested: paraphrase, humanize, simplify, academic, and summarize expand. Each style is chained for up to five hops, producing 160,500 rewritten texts in total. The watermark is detected on 87.9% of the original outputs at the standard significance threshold. After a single rewrite, detection falls to between 14% and 41% depending on the rewriter and style. After five chained rewrites, detection falls to 4.86%, meaning 94.76% of the originally detected texts are no longer flagged. After three rewrites, the detector score has dropped 86% of the way from its watermarked baseline toward the null distribution. Repeated rewriting is therefore a much stronger attack than a single rewrite, and the result holds across all four rewriters tested.

Mohd Ruhul Ameen, Akif Islam, Nadim Mahmud +1

College of Engineering and Computer Science, Marshall University, Huntington, WV, USA · Department of Computer Science and Engineering, University of Rajshahi, Rajshahi, Bangladesh · Miami University, Oxford, OH 45056, USA

Large Language Model Watermarks Watermarks Diffusion Language Models Attacker Large Language Model Machine-Generated Text Detection Rewrite+1

Ask PDF

Sep 29, 2025cs.LG

Watermarking Diffusion Language Models

We introduce the first watermark tailored for diffusion language models (DLMs), an emergent LLM paradigm able to generate tokens in arbitrary order, in contrast to standard autoregressive language models (ARLMs) which generate tokens sequentially. While there has been much work in ARLM watermarking, a key challenge when attempting to apply these schemes directly to the DLM setting is that they rely on previously generated tokens, which are not always available with DLM generation. In this work we address this challenge by: (i) applying the watermark in expectation over the context even when some context tokens are yet to be determined, and (ii) promoting tokens which increase the watermark strength when used as context for other tokens. This is accomplished while keeping the watermark detector unchanged. Our experimental evaluation demonstrates that the DLM watermark leads to a >99% true positive rate with minimal quality impact and achieves similar robustness to existing ARLM watermarks, enabling for the first time reliable DLM watermarking.

Thibaud Gloaguen, Robin Staab, Nikola Jovanović +1

ETH Zurich

Large Language Model Watermarks Diffusion Language Models

Ask PDF