Constitution-Guided Watermarking

Toluwani Aremu; Samuele Poppi; Nils Lukas

cs.CROct 7, 2026

Constitution-Guided Watermarking

Authors: Toluwani Aremu, Samuele Poppi, Nils Lukas

Organizations: MBZUAI, Abu Dhabi, United Arab Emirates

Abstract

Watermarking enables language model providers to identify text generated by their models. However, its desired properties can conflict (\ie~stronger watermark signals can degrade text quality), while designs that resist editing may also facilitate forgery. Providers address these trade-offs by choosing configurations that balance competing objectives or prioritize particular properties. Either approach imposes a shared operating point on requests with different requirements, potentially sacrificing quality where wording preservation matters or robustness where reliable attribution is essential. To allow flexible and adaptable designs, we introduce \emph{Constitution-Guided Watermarking}, a framework that selects request-appropriate trade-offs from provider requirements, listed as natural-language principles. \emph{Offline}, a pretrained reasoning agent examines constitutional rules alongside watermark implementations and iteratively refines rule-specific configurations using empirical feedback. \emph{At deployment}, a separate monitor identifies applicable rules and retrieves the corresponding policy, including watermarking exemptions, without modifying the serving model. Furthermore, our framework supports offline parallel optimization and refinement of rule-specific configurations based on evolving provider requirements without affecting deployment, and binds each deployed configuration to its evaluation evidence, making deployment decisions auditable. In a proof-of-concept evaluation using KGW and a five-rule constitution, our framework selects configurations responsive to provider priorities and improves post-paraphrase detection on robustness-prioritized requests by up to $14$ percentage points over fixed configurations, while matching or exceeding all baselines in aggregate quality and clean detection at a nominal $0.1\%$ false-positive rate.

Figures & tables

Figure 1: Conceptual illustration: (a) offline, the verification agent assigns each rule a configuration; (b) at deployment, the monitor routes a prompt to its rule. Rules shown are illustrative.

Figure 2: Constitution-Guided Watermarking framework.

	Input: $A_{\theta}$ , constitution $\mathcal{C}$ , source $S$ , legal domains $\{\Psi_{a}\}$ , frozen $\mathcal{M}$ , $\mathcal{D}_{\mathrm{ref}}$ , budget $T$
	Output: policy $\mathcal{P}$ with measured incumbents and gate status
1	$U\leftarrow$ watermarked profiles; $H_{c}\leftarrow\emptyset$ for every $c\in U$
	$\triangleright$ Refine configurations using reference-set feedback.
2	for $t=1,\ldots,T$ while $U\neq\emptyset$ do
3	$Z\leftarrow A_{\theta}(\mathcal{C},S,U,\{H_{c}\}_{c\in U})$
	$\triangleright$ Reject illegal configurations before generation.

Algorithm 1 Source-grounded constitutional configuration search

	Input: $M_{\varphi}$ , prompt $\pi$ , constitution $\mathcal{C}$ , evidence index $\mathcal{I}$ for policy $\mathcal{P}$ , frozen $\mathcal{M}$
	$\triangleright$ Identify applicable rules and resolve overlapping requirements.
1	$\widehat{\mathcal{S}}(\pi)\leftarrow M_{\varphi}(\pi,\mathcal{C},\mathcal{I})$
2	$c\leftarrow\textsc{ResolveAndAggregate}(\widehat{\mathcal{S}}(\pi),\mathcal{C})$
3	$z\leftarrow\textsc{RetrieveRecord}(c,\mathcal{I})$
	$\triangleright$ Use the provider’s fallback when no authorized policy can be applied.
4	if uncertain, missing, or unauthorized then return ProviderFallback $(\pi,c)$

Algorithm 2 Constrained constitutional deployment

Scenario	Action	Constitutional priority
Misuse-prone requests	WM	Robustness over quality
Low-risk editing	NoWM	No watermark application
High-stakes advice	WM	Quality, low distortion, high detection
Deterministic answers	WM	Quality and detectability
General generation	WM	Minimize unnecessary distortion

Table 1: Provider constitution , in first-applicable precedence order.

	Clean Detection		Quality	Robustness ( $\alpha=0.1\%$ )		Compliance
Method	$\alpha=1.0\%$	$\alpha=0.1\%$	PPL $\leq 18.25$	DIAA	DIPPER	Exempt
Fixed baselines
Fixed KGW A	$95.5\;_{[93.5,\,97.5]}$	$92.5\;_{[90.0,\,95.0]}$	$98.4\;_{[97.2,\,99.4]}$	$\phantom{0}2.8\;_{[1.0,\,4.8]}$	$\phantom{0}3.0\;_{[1.6,\,4.6]}$	00 0.0
Fixed KGW B	$80.0\;_{[76.3,\,83.8]}$	$61.8\;_{[57.3,\,66.3]}$	$98.2\;_{[97.0,\,99.2]}$	$\phantom{0}1.4\;_{[0.4,\,2.4]}$	$\phantom{0}8.6\;_{[6.0,\,11.4]}$	00 0.0
Constitutional framework
Random-search verifier	$\mathbf{98.0}\;_{[96.5,\,99.3]}$	$\mathbf{97.5}\;_{[96.0,\,99.0]}$	$97.2\;_{[95.8,\,98.6]}$	$12.2\;_{[8.0,\,17.0]}$	$11.6\;_{[8.4,\,15.0]}$	$\mathbf{100.0}$

Table 2: Main results. Clean detection covers watermark-required rules (

n=400

); quality measures PPL

\leq 18.25

on the same prompts. Robustness covers 100 robustness-required prompts (5 attacks/response). Brackets show 95% percentile-bootstrap intervals, clustered by prompt for robustness. The two constitutional rows share the framework, monitor, gates, and budget, and differ only in the verifier. All values are percentages; best results are bolded . Robustness at

\alpha=1\%

is in Appendix C.4 .

Reference-set measure	Initial	Final
KGW bias, $\delta$	3	6
Clean detection ( $\alpha=0.1\%$ )	0 90.0	100.0
Quality pass rate	100.0	100.0
Worst-channel robustness	00 0.0	0 10.0
Policy status	–	Best-effort

Table 3: Impact of Iterative Refinement.

\gamma=0.5

h=4

, and

f=\texttt{min}

are unchanged. Detection uses nominal

\alpha=0.1\%

. Rates are percentages; best results are bolded . Full trace in Appendix C.5 .

		Clean Detection		Quality	Robustness ( $\alpha=0.1\%$ )
Constitution	$(\delta,h,f)$	$\alpha=1.0\%$	$\alpha=0.1\%$	PPL $\leq 18.25$	DIAA	DIPPER
Quality-first	$(2,1,\texttt{time})$	$\phantom{0}93.0\;_{[86.1,\,97.1]}$	$91.0\;_{[83.6,\,95.8]}$	$\mathbf{98.0}\;_{[93.0,\,99.8]}$	$\phantom{0}4.6\;_{[2.4,\,7.6]}$	$\phantom{0}5.6\;_{[3.0,\,8.4]}$
Robustness-first	$(6,2,\texttt{additive})$	$\mathbf{100.0}\;_{[96.4,\,100.0]}$	$\mathbf{98.0}\;_{[93.0,\,99.8]}$	$91.0\;_{[83.6,\,95.8]}$	$\mathbf{15.6}\;_{[12.5,\,19.1]}$	$\mathbf{18.6}\;_{[15.3,\,22.3]}$
Balanced	$(4,1,\texttt{time})$	$\phantom{0}98.0\;_{[93.0,\,99.8]}$	$97.0\;_{[91.5,\,99.4]}$	$94.0\;_{[87.4,\,97.8]}$	$13.2\;_{[8.6,\,18.0]}$	$17.0\;_{[13.2,\,21.4]}$

Table 4: Constitution sensitivity on 100 held-out prompts. Each variant runs the same pipeline under a different constitution priority; all selected

\gamma=0.5

. Configurations are

(\delta,h,f)

. Quality measures PPL

\leq 18.25

; robustness uses five attacks per response at nominal

\alpha=0.1\%

. Quality and clean-detection brackets are 95% Clopper–Pearson intervals; robustness brackets are 95% bootstrap intervals clustered by prompt. All values are percentages; higher is better. Best results are bolded .

Router Policy	Assignment	$\alpha=1.0\%$	$\alpha=0.1\%$	PPL $\leq 18.25$	DIAA	DIPPER	Compliance	Failures (/500)
	Rule	Clean Detection		Quality	Robustness ( $\alpha=0.1\%$ )		Policy Action	Routing
gpt-5-nano (low reasoning)	0 $70.6$	$87.5$	$84.5$	$91.0$	$10.2$	$16.4$	0 $75.0$	36
gpt-5.4-nano (high reasoning)	100.0	98.0	97.5	98.0	13.8	17.0	100.0	0 0

Table 5: Impact of deployment monitor. Clean detection is averaged over watermark-required rules (

n=400

); robustness covers 100 prompts under paraphrase attack at

\alpha=0.1\%

; quality measures PPL

\leq 18.25

across advice and deterministic requests (

n=200

). Rates are percentages; best results are bolded . Evasion probes and a routing rerun are in Appendix C.6 .

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Rule (priority)	Reasoning verifier (C-KGW)	Random-search verifier
Misuse (robustness over quality)	$(0.5,6,4,\texttt{min})$	$(0.4109,4,2,\texttt{min})$
Editing (exempt)	NoWM	NoWM
Advice (quality, low distortion)	$(0.5,4,1,\texttt{additive})$	$(0.5603,5,6,\texttt{time})$
Deterministic (quality, detection)	$(0.5,4,1,\texttt{additive})$	$(0.6056,27,1,\texttt{skip})$
General (minimize distortion)	$(0.5,4,1,\texttt{additive})$	$(0.5763,6,6,\texttt{min})$

Appendix

Table 6: Configurations stored per rule. Tuples are

(\gamma,\delta,h,f)

: green-list fraction, logit bias, context length, and seeding function. Rules are listed in precedence order. Reasoning-verifier configurations for advice, deterministic answers, and general generation are Reference-Passed ; misuse is Best-Effort (Table 3 ). Random-search

\gamma

is rounded for display only.

Detector / Use	$(\gamma,h,f)$	$\eta_{\alpha}$	Observed FPR	$\eta_{\alpha}$	Observed FPR
		Nominal $\alpha=1.0\%$		Nominal $\alpha=0.1\%$
Fixed KGW A	$(0.25,3,\texttt{time})$	2.531	$0.940\;_{[0.691,\,1.248]}$	3.408	$0.080\;_{[0.022,\,0.205]}$
Fixed KGW B	$(0.5,1,\texttt{time})$	2.776	$1.060\;_{[0.795,\,1.384]}$	3.842	$0.160\;_{[0.069,\,0.315]}$
Reasoning: non-misuse	$(0.5,1,\texttt{additive})$	2.776	$1.060\;_{[0.795,\,1.384]}$	3.842	$0.160\;_{[0.069,\,0.315]}$
Reasoning: misuse	$(0.5,4,\texttt{min})$	2.371	$1.040\;_{[0.778,\,1.362]}$	3.208	$0.140\;_{[0.056,\,0.288]}$
Random search: deterministic	$(0.6056,1,\texttt{skip})$	2.967	$1.000\;_{[0.743,\,1.316]}$	4.111	$0.140\;_{[0.056,\,0.288]}$

Appendix

Table 7: Measured null-reference FPRs, not an independent final audit. Each row tests 5,000 unwatermarked texts disjoint from threshold calibration; their feedback was reused during configuration selection.

\eta_{\alpha}

is the calibrated detection threshold at nominal FPR

\alpha

. Brackets give two-sided 95% Clopper–Pearson intervals; these are descriptive, not guarantees after adaptive selection. The provider’s looser 1% cap is a separate requirement. Detector tuples are

(\gamma,h,f)

with fixed key and tokenizer; generation bias

\delta

does not affect the score. Random-search

\gamma

is rounded for display only. The reasoning verifier’s three non-misuse rules share one detector, which coincides with Fixed KGW B’s because for

h=1

every seeding function reduces to the preceding token. Rates are percentages.

	Robustness ( $\alpha=1.0\%$ )
Method	DIAA	DIPPER
Fixed KGW A	$\phantom{0}8.6\;_{[5.6,\,12.2]}$	$11.8\;_{[8.6,\,15.4]}$
Fixed KGW B	$\phantom{0}8.8\;_{[5.8,\,12.0]}$	$19.0\;_{[14.8,\,23.4]}$
Random-search verifier	$26.6\;_{[20.4,\,33.0]}$	$28.2\;_{[23.0,\,33.6]}$
Reasoning verifier (C-KGW, ours)	$\mathbf{27.8}\;_{[21.8,\,34.4]}$	$\mathbf{30.8}\;_{[25.6,\,36.2]}$

Appendix

Table 8: Robustness at nominal

\alpha=1\%

. Post-paraphrase detection on the 100 robustness-required prompts (5 attacks/response), under the same generations, attacks, and routing as Table 2 . Brackets show 95% percentile-bootstrap intervals, clustered by prompt. All values are percentages; higher is better. Best results are bolded .

Nominal FPR	Attack	Reasoning	Random search	Difference
$0.1\%$	DIAA	13.8	12.2	$+1.6\;_{[-2.6,\,3.8]}$
	DIPPER	17.0	11.6	$\mathbf{+5.4}\;_{[0.6,\,10.2]}$
$1.0\%$	DIAA	27.8	26.6	$+1.2\;_{[-7.8,\,5.2]}$
	DIPPER	30.8	28.2	$+2.6\;_{[-3.8,\,9.2]}$

Appendix

Table 9: Paired robustness differences, reasoning verifier (C-KGW) minus random-search verifier. Both methods are evaluated on the same 100 robustness-required prompts (5 attacks/response). Brackets show 95% paired percentile-bootstrap intervals over source prompts (10,000 replicates), keeping each prompt’s attack repetitions together; attack failures count as misses. Rates are percentages; differences are in percentage points.

Panel of Figure 3 — Figure 3: Configuration refinement for the misuse rule. Results are measured on the 10-prompt reference set at nominal $\alpha=0.1\%$ against the gates detection $\geq 0.95$ , quality $\geq 0.90$ , and robustness $\geq 0.50$ ; ✓ / ✗ mark whether each is met. Robustness counts detections over $50$ attacked responses (10 prompts $\times$ 5 attacks), taking the worse of DIAA and DIPPER.

Panel of Figure 4 — Figure 4: Deployment routing by the lightweight monitor. Examples 1 and 2 share a medical subject but differ in the requested operation; Example 3 shows an omitted applicable rule. Prompts and rationales are verbatim; rule identifiers are mapped to the names used in Appendix B.4 .

Probe set	Expected route	$n$	Correct route (%)
Misuse framed as editing: corpus prompts	Misuse $\rightarrow$ WM	8	$100.0\;_{[63.1,\,100.0]}$
Misuse framed as editing: generated probes	Misuse $\rightarrow$ WM	42	$100.0\;_{[91.6,\,100.0]}$
Misuse framed as editing: all	Misuse $\rightarrow$ WM	50	$\mathbf{100.0}\;_{[92.9,\,100.0]}$
Editing-only controls (corpus)	Editing $\rightarrow$ NoWM	50	$98.0\;_{[89.4,\,99.9]}$

Appendix

Table 10: Exemption-evasion pilot ( gpt-5.4-nano , high reasoning). Under first-applicable precedence, misuse precedes editing, so misuse requests framed as editing should be routed to the misuse rule and watermarked. Brackets give two-sided 95% Clopper–Pearson intervals. No routing failures occurred.

Monitor	Prompts	$n$	Correct rule (%)	Correct decision (%)	Failures
gpt-5-nano (low)	Overlapping	97	$72.2\;_{[62.1,\,80.8]}$	93.8	4
	Single-rule	403	$70.2\;_{[65.5,\,74.6]}$	88.6	32
	All	500	$70.6\;_{[66.4,\,74.6]}$	89.6	36
gpt-5.4-nano (high)	Overlapping	97	$95.9\;_{[89.8,\,98.9]}$	97.9	0
	Single-rule	403	$97.3\;_{[95.2,\,98.6]}$	99.0	0
	All	500	$97.0\;_{[95.1,\,98.3]}$	98.8	0

Appendix

Table 11: Routing on overlapping and single-rule test prompts. Overlapping prompts are annotated with more than one applicable rule. gpt-5-nano results come from the end-to-end run in Table 5 ; gpt-5.4-nano results come from a separate routing-only rerun with the same instruction, frozen policy, and enforcer. Decision accuracy is the resulting WM/NoWM decision over all prompts, distinct from the editing-only compliance in Table 5 . Routing failures count as incorrect; brackets give two-sided 95% Clopper–Pearson intervals for rule assignment.

Explore similar work

Aug 13, 2026cs.CR

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits.

Xiaoyan Feng, Yanjun Zhang, He Zhang +2

Griffith University

Large Language Model Watermarks Tamper Localization Machine-Generated Text Detection Attacker Large Language Model Provenance Spoofing+1

Ask PDF

May 28, 2026cs.CL

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

Watermarking embeds statistical signatures in AI-generated text for detection and attribution. We reveal a fundamental vulnerability: when users access multiple models (today's reality), watermarks trivially fail. Watermarks perturb output distributions away from the original, and in competitive markets, these perturbations are typically independent across providers. We theoretically prove that averaging output probability distributions recovers the unwatermarked distribution with up to a second-order error term. Empirically, simply averaging 3-5 models cancels out these perturbations. We introduce WASH (Watermark Attenuation via Statistical Hybridisation), which solves practical challenges in ensemble generation: vocabulary misalignment and tokenisation differences across heterogeneous models. Experiments across six watermarking schemes and three LLMs show that averaging across 3 models suppresses detection z-scores from 5-300 to below 2 (below the detection threshold of 4) and reduces TPR at 5% FPR to below 50%, while improving quality by 27.5% and running 6 times faster than the best baseline on the long sequence generation. Our results suggest that robust AI-text detection via watermarking requires either accepting this fundamental vulnerability or unprecedented coordination among model providers.

Zhihao Wu, Gracia Gong, Qinglin Zhu +2

Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.

Large Language Model Watermarks Watermarks Watermarking Machine-Generated Text Detection Attacker Large Language Model Ensemble+2

Ask PDF

May 12, 2026cs.CR

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection

We introduce TextSeal, a state-of-the-art watermark for large language models. Building on Gumbel-max sampling, TextSeal introduces dual-key generation to restore output diversity, along with entropy-weighted scoring and multi-region localization for improved detection. It supports serving optimizations such as speculative decoding and multi-token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free, and evaluation across reasoning benchmarks confirms that it preserves downstream performance; while a multilingual human evaluation (6000 A/B comparisons, 5 languages) shows no perceptible quality difference. Beyond its use for provenance detection, TextSeal is also ``radioactive'': its watermark signal transfers through model distillation, enabling detection of unauthorized use.

Tom Sander, Hongyan Chang, Tomáš Souček +10

FAIR, Meta Superintelligence Labs

Large Language Model Watermarks Watermarking Machine-Generated Text Detection Tamper Localization Provenance Distribution Matching Distillation

Ask PDF