Anchor-ECC: Local Integrity Checking for Watermarked LLM Outputs via Error-Correcting Codes

Zewei Deng; Muhammad Siddeek; Liyan Xie; Mohamed Seif; Mengdi Wang; H. Vincent Poor; Andrea Goldsmith

cs.CRSep 30, 2026

Anchor-ECC: Local Integrity Checking for Watermarked LLM Outputs via Error-Correcting Codes

Authors: Zewei Deng, Muhammad Siddeek, Liyan Xie, Mohamed Seif, Mengdi Wang, H. Vincent Poor, Andrea Goldsmith

Organizations: University of Minnesota · Google · Oakland University · Princeton University ·

Abstract

LLM watermarking has become an effective approach to distinguishing AI-generated text from human-written text by embedding detectable patterns during generation. However, a small post-generation edit may change the meaning of the text without removing its overall watermark signal, creating a risk that the modified content is still attributed to the original model. We propose Anchor-ECC, which incorporates the error-correcting code (ECC) constraints and explicit boundary anchors into the watermark structure and pairs them with a dynamic-programming decoder to detect and localize post-generation edits. Across Qwen3-8B, Mistral-7B-Instruct-v0.3, and OPT-125M, the approximate-hard setting achieves about 99.7% block-level true positive rate (TPR) with at most 7.6% false alarm rate (FAR) for edit detection under mixed insertions, deletions, and substitutions, while preserving the distinction between watermarked outputs and unwatermarked text. Additional quality experiments identify lower-perplexity configurations that retain strong edit-detection performance. Together, these results extend LLM watermarking from source identification to local integrity verification while supporting configurable trade-offs between detection reliability and generation quality.

Figures & tables

Figure 1: Left: Overview of the Anchor-ECC watermark embedding procedure. The tokenizer vocabulary is partitioned into two buckets

\mathcal{B}_{0},\mathcal{B}_{1}

and a disjoint boundary-anchor bucket

\mathcal{B}_{\mathrm{bd}}

. The feasible codeword set

\mathcal{C}=\mathcal{V}_{a}(n)\cap\mathcal{H}

combines VT and Hamming constraints. During Anchor-ECC generation, the adaptive generator tracks the current block prefix and restricts or biases the next-token distribution toward feasible bits, while boundary anchors close each structural block. Right: Overview of block-addressable integrity detection and candidate refinement using an insertion example. The edited text is first decoded into structural symbols, globally parsed into structural blocks, and then checked against the feasible codeword set

\mathcal{C}

. A block is flagged as suspicious when its minimum edit distance to the feasible set exceeds the tolerance threshold

r

Model	$\delta$	Clean	TPR $\uparrow$	FAR $\downarrow$	Cov. $\uparrow$
Qwen3-8B	2	1.78	0.2621	0.0839	0.5103
	5	6.84	0.5217	0.2107	0.6106
	20	16.71	0.9966	0.0754	0.7811
Mistral-7B	2	1.70	0.2630	0.0851	0.5108
	5	5.34	0.5443	0.2119	0.5874
	20	17.93	0.9978	0.0071	0.8009

Table 1: Three-model LFQA results, macro-averaged over four edit rates and three edit budgets. Clean is the mean number of initially feasible blocks among 18; Cov. is candidate coverage.

	$\delta=2$		$\delta=5$		$\delta=20$
Method	TPR $\uparrow$	FAR $\downarrow$	TPR $\uparrow$	FAR $\downarrow$	TPR $\uparrow$	FAR $\downarrow$
Anchor-ECC	0.2621	0.0839	0.5217	0.2107	0.9966	0.0754
Sync-VT	0.8880	0.8880	0.8828	0.8793	0.7464	0.1029
KGW	0.9558	0.8909	0.8774	0.5672	0.7772	0.1003
Zhao-AOL	0.7173	0.6093	0.7560	0.4963	0.7848	0.1592
WaterSeeker	0.2898	0.1951	0.3132	0.1273	0.3438	0.0259

Table 2: Qwen3/LFQA block detection across watermark strengths, macro-averaged over four edit rates and

k\in\{1,2,3\}

$\delta$	Intent	Texts	Edited blocks	TPR $\uparrow$	FAR $\downarrow$	Cov. $\uparrow$
5	Overall	72	5.75	0.8261	0.1814	0.4169
	Benign	36	6.00	0.8380	0.2153	0.5088
	Malicious	36	5.50	0.8131	0.1489	0.3422
20	Overall	72	5.33	0.9193	0.0921	0.5040
	Benign	36	5.44	0.9337	0.0951	0.5520
	Malicious	36	5.22	0.9043	0.0891	0.4608

Table 3: Block detection and candidate coverage on the balanced Qwen3 LLM-guided edit sample. Edited blocks is the mean number per text.

Model	$\delta=2$	$\delta=5$	$\delta=20$
Qwen3-8B	0.99847	0.99988	0.99998
Mistral-7B	1.00000	0.99998	1.00000
OPT-125M	0.99908	1.00000	0.99958

Table 4: Global watermark-identifiability ROC-AUC under the compact-anchor protocol, using matched unwatermarked generations and human LFQA answers as negatives.

Model	$\delta$	Compact-150	Boundary- $1/8$	Reduction
Qwen3-8B	2	22.98	12.54	45.4%
	5	32.27	15.43	52.2%
	20	67.04	30.11	55.1%
Mistral-7B	2	11.20	8.27	26.1%
	5	15.80	10.41	34.1%
	20	44.68	18.04	59.6%

Table 5: Conditional perplexity (PPL) for compact-150 and boundary-

1/8

anchor allocations (lower is better). “Reduction” reports the percentage decrease in PPL when replacing the default compact-150 allocation with boundary-

1/8

, providing an ablation study of how anchor allocation affects PPL.

Prompt 1: why do marathoners and triathletes tend to have small body frames?
$\delta=2$	Marathoners and triathletes frequently have smaller body frames due to the typical demands of their sports.
$\delta=20$	Marathoners and triathlon athletes frequently have smaller body frames due to competitive modesty, which is an advantage since typical running efficiency reduces the amount waste carried across long distances.
Prompt 2: what are magnet links? Context: I see them on lots of torrent sites.
$\delta=2$	Magnet links are a type of widely used hyperlink that allows users to locate nearly any file on the internet without requiring beforehand knowledge of where it is stored.
$\delta=20$	Magnet links are URL-based addresses primarily used to locate and retrieve digital files across peer-to-peer network systems; they directly reference the content identified by hash values specifically generated for each item stored digitally along separate nodes.
Prompt 3: why does the education system favours memory retention over imagination?

Table 6: Matched verbatim sentence prefixes from saved Qwen3-8B generations. Text is truncated only at sentence boundaries and is not rewritten.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

$\delta$	Attack	TPR $\uparrow$	FAR $\downarrow$	Cov. $\uparrow$
2	Insertion	0.8890	0.8881	0.2994
	Deletion	0.8878	0.8892	0.4149
	Substitution †	0.8872	0.8868	0.0000
5	Insertion	0.8828	0.8776	0.2983
	Deletion	0.8885	0.8790	0.4176
	Substitution †	0.8771	0.8814	0.0000

Appendix

Table 7: Sync-VT on Qwen3/LFQA, macro-averaged over four edit rates and

k\in\{1,2,3\}

. † The original construction addresses insertion and deletion; substitution results are reported for completeness under the shared mixed-edit protocol.

Model	Method	$\delta=2$		$\delta=5$		$\delta=20$
Model	Method	TPR	FAR	TPR	FAR	TPR	FAR
Qwen3-8B	Anchor-ECC	0.2621	0.0839	0.5217	0.2107	0.9966	0.0754
	KGW	0.9558	0.8909	0.8774	0.5672	0.7772	0.1003
	Zhao-AOL	0.7173	0.6093	0.7560	0.4963	0.7848	0.1592
	WaterSeeker	0.2898	0.1951	0.3132	0.1273	0.3438	0.0259
Mistral-7B	Anchor-ECC	0.2630	0.0851	0.5443	0.2119	0.9978	0.0071

Appendix

Table 8: Full LFQA sweep for Anchor-ECC and KGW-based baselines. Each entry is macro-averaged over four edit rates and

k\in\{1,2,3\}

Edit Rate	Method	TPR $\uparrow$	FAR $\downarrow$
0.2	Anchor-ECC	0.9989	0.0730
	KGW	0.6922	0.0350
	Zhao-AOL	0.7983	0.0776
	WaterSeeker	0.4568	0.0232
0.4	Anchor-ECC	0.9973	0.0747
	KGW	0.7052	0.0571

Appendix

Table 9: Block-level edit detection under the single-edit setting (

k=1

), where each affected block receives one mixed edit sampled from substitution, insertion, and deletion. AOL denotes KGW+AOL, and WS denotes KGW+WaterSeeker.

$\delta$	Edited blocks	Visible blocks	Visibility	Visible TPR
5	414	374	0.9034	0.8690
20	384	350	0.9115	1.0000

Appendix

Table 10: Structural visibility in the balanced LLM-guided sample. A block is visible when its final bucket sequence differs from the original. Visible TPR is the fraction of these visible edited blocks that are flagged.

$\delta$	Motivation	Blocks (E/C)	TPR $\uparrow$	FAR $\downarrow$	Cov. $\uparrow$
5	grammar_polish	72/144	0.8056	0.2292	0.5931
	clarity_improvement	66/150	0.8788	0.2000	0.4522
	style_softening	78/138	0.8333	0.2174	0.4870
	claim_distortion	65/151	0.8154	0.1192	0.3758
	stance_shift	66/150	0.7879	0.1533	0.3204
	source_spoofing	67/149	0.8358	0.1745	0.3368

Appendix

Table 11: Qwen3 LLM-guided edit results by motivation. E/C gives the numbers of edited and clean blocks. The first three motivations are benign and the last three are malicious.

Error-Correcting Codes

See all 30 papers

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks
Aug 13, 2026Xiaoyan Feng, Yanjun Zhang, He Zhang +2Data Provenance LLM Watermarking
Griffith University
RMCW: A Deletion-Robust Watermark Based on Reed--Muller Codes for Language Models
Oct 2, 2026Yi Wang, Baicheng Chen, Yu Wang +3LLM Watermarking Robust Watermarking
Institute for Interdisciplinary Information Sciences, Tsinghua University · University of Wisconsin–Madison · Shanghai Qi Zhi Institute, 3Xiongan AI Institute +2
ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models
Oct 10, 2026Xiaopu Wang, Runze LiText Watermarking LLM Watermarking

Aug 13, 2026J/K move · Enter open · S save

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

Xiaoyan Feng, Yanjun Zhang, He Zhang, Leo Yu Zhang+1

Griffith University

Data Provenance LLM Watermarking Robust Watermarking Robustness of Machine-Generated Text Detection

Open paper AskPDF arXiv

Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits.

Abstract

Error-Correcting Codes

Explore similar work

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

RMCW: A Deletion-Robust Watermark Based on Reed--Muller Codes for Language Models

ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models