Constitution-Guided Watermarking

Toluwani Aremu; Samuele Poppi; Nils Lukas

cs.CROct 7, 2026

Constitution-Guided Watermarking

Authors: Toluwani Aremu, Samuele Poppi, Nils Lukas

Organizations: MBZUAI, Abu Dhabi, United Arab Emirates

Abstract

Watermarking enables language model providers to identify text generated by their models. However, its desired properties can conflict (\ie~stronger watermark signals can degrade text quality), while designs that resist editing may also facilitate forgery. Providers address these trade-offs by choosing configurations that balance competing objectives or prioritize particular properties. Either approach imposes a shared operating point on requests with different requirements, potentially sacrificing quality where wording preservation matters or robustness where reliable attribution is essential. To allow flexible and adaptable designs, we introduce \emph{Constitution-Guided Watermarking}, a framework that selects request-appropriate trade-offs from provider requirements, listed as natural-language principles. \emph{Offline}, a pretrained reasoning agent examines constitutional rules alongside watermark implementations and iteratively refines rule-specific configurations using empirical feedback. \emph{At deployment}, a separate monitor identifies applicable rules and retrieves the corresponding policy, including watermarking exemptions, without modifying the serving model. Furthermore, our framework supports offline parallel optimization and refinement of rule-specific configurations based on evolving provider requirements without affecting deployment, and binds each deployed configuration to its evaluation evidence, making deployment decisions auditable. In a proof-of-concept evaluation using KGW and a five-rule constitution, our framework selects configurations responsive to provider priorities and improves post-paraphrase detection on robustness-prioritized requests by up to $14$ percentage points over fixed configurations, while matching or exceeding all baselines in aggregate quality and clean detection at a nominal $0.1\%$ false-positive rate.

Figures & tables

Figure 1: Conceptual illustration: (a) offline, the verification agent assigns each rule a configuration; (b) at deployment, the monitor routes a prompt to its rule. Rules shown are illustrative.

Figure 2: Constitution-Guided Watermarking framework.

	Input: $A_{\theta}$ , constitution $\mathcal{C}$ , source $S$ , legal domains $\{\Psi_{a}\}$ , frozen $\mathcal{M}$ , $\mathcal{D}_{\mathrm{ref}}$ , budget $T$
	Output: policy $\mathcal{P}$ with measured incumbents and gate status
1	$U\leftarrow$ watermarked profiles; $H_{c}\leftarrow\emptyset$ for every $c\in U$
	$\triangleright$ Refine configurations using reference-set feedback.
2	for $t=1,\ldots,T$ while $U\neq\emptyset$ do
3	$Z\leftarrow A_{\theta}(\mathcal{C},S,U,\{H_{c}\}_{c\in U})$
	$\triangleright$ Reject illegal configurations before generation.

Algorithm 1 Source-grounded constitutional configuration search

	Input: $M_{\varphi}$ , prompt $\pi$ , constitution $\mathcal{C}$ , evidence index $\mathcal{I}$ for policy $\mathcal{P}$ , frozen $\mathcal{M}$
	$\triangleright$ Identify applicable rules and resolve overlapping requirements.
1	$\widehat{\mathcal{S}}(\pi)\leftarrow M_{\varphi}(\pi,\mathcal{C},\mathcal{I})$
2	$c\leftarrow\textsc{ResolveAndAggregate}(\widehat{\mathcal{S}}(\pi),\mathcal{C})$
3	$z\leftarrow\textsc{RetrieveRecord}(c,\mathcal{I})$
	$\triangleright$ Use the provider’s fallback when no authorized policy can be applied.
4	if uncertain, missing, or unauthorized then return ProviderFallback $(\pi,c)$

Algorithm 2 Constrained constitutional deployment

Scenario	Action	Constitutional priority
Misuse-prone requests	WM	Robustness over quality
Low-risk editing	NoWM	No watermark application
High-stakes advice	WM	Quality, low distortion, high detection
Deterministic answers	WM	Quality and detectability
General generation	WM	Minimize unnecessary distortion

Table 1: Provider constitution , in first-applicable precedence order.

	Clean Detection		Quality	Robustness ( $\alpha=0.1\%$ )		Compliance
Method	$\alpha=1.0\%$	$\alpha=0.1\%$	PPL $\leq 18.25$	DIAA	DIPPER	Exempt
Fixed baselines
Fixed KGW A	$95.5\;_{[93.5,\,97.5]}$	$92.5\;_{[90.0,\,95.0]}$	$98.4\;_{[97.2,\,99.4]}$	$\phantom{0}2.8\;_{[1.0,\,4.8]}$	$\phantom{0}3.0\;_{[1.6,\,4.6]}$	00 0.0
Fixed KGW B	$80.0\;_{[76.3,\,83.8]}$	$61.8\;_{[57.3,\,66.3]}$	$98.2\;_{[97.0,\,99.2]}$	$\phantom{0}1.4\;_{[0.4,\,2.4]}$	$\phantom{0}8.6\;_{[6.0,\,11.4]}$	00 0.0
Constitutional framework
Random-search verifier	$\mathbf{98.0}\;_{[96.5,\,99.3]}$	$\mathbf{97.5}\;_{[96.0,\,99.0]}$	$97.2\;_{[95.8,\,98.6]}$	$12.2\;_{[8.0,\,17.0]}$	$11.6\;_{[8.4,\,15.0]}$	$\mathbf{100.0}$

Table 2: Main results. Clean detection covers watermark-required rules (

n=400

); quality measures PPL

\leq 18.25

on the same prompts. Robustness covers 100 robustness-required prompts (5 attacks/response). Brackets show 95% percentile-bootstrap intervals, clustered by prompt for robustness. The two constitutional rows share the framework, monitor, gates, and budget, and differ only in the verifier. All values are percentages; best results are bolded . Robustness at

\alpha=1\%

is in Appendix C.4 .

Reference-set measure	Initial	Final
KGW bias, $\delta$	3	6
Clean detection ( $\alpha=0.1\%$ )	0 90.0	100.0
Quality pass rate	100.0	100.0
Worst-channel robustness	00 0.0	0 10.0
Policy status	–	Best-effort

Table 3: Impact of Iterative Refinement.

\gamma=0.5

h=4

, and

f=\texttt{min}

are unchanged. Detection uses nominal

\alpha=0.1\%

. Rates are percentages; best results are bolded . Full trace in Appendix C.5 .

		Clean Detection		Quality	Robustness ( $\alpha=0.1\%$ )
Constitution	$(\delta,h,f)$	$\alpha=1.0\%$	$\alpha=0.1\%$	PPL $\leq 18.25$	DIAA	DIPPER
Quality-first	$(2,1,\texttt{time})$	$\phantom{0}93.0\;_{[86.1,\,97.1]}$	$91.0\;_{[83.6,\,95.8]}$	$\mathbf{98.0}\;_{[93.0,\,99.8]}$	$\phantom{0}4.6\;_{[2.4,\,7.6]}$	$\phantom{0}5.6\;_{[3.0,\,8.4]}$
Robustness-first	$(6,2,\texttt{additive})$	$\mathbf{100.0}\;_{[96.4,\,100.0]}$	$\mathbf{98.0}\;_{[93.0,\,99.8]}$	$91.0\;_{[83.6,\,95.8]}$	$\mathbf{15.6}\;_{[12.5,\,19.1]}$	$\mathbf{18.6}\;_{[15.3,\,22.3]}$
Balanced	$(4,1,\texttt{time})$	$\phantom{0}98.0\;_{[93.0,\,99.8]}$	$97.0\;_{[91.5,\,99.4]}$	$94.0\;_{[87.4,\,97.8]}$	$13.2\;_{[8.6,\,18.0]}$	$17.0\;_{[13.2,\,21.4]}$

Table 4: Constitution sensitivity on 100 held-out prompts. Each variant runs the same pipeline under a different constitution priority; all selected

\gamma=0.5

. Configurations are

(\delta,h,f)

. Quality measures PPL

\leq 18.25

; robustness uses five attacks per response at nominal

\alpha=0.1\%

. Quality and clean-detection brackets are 95% Clopper–Pearson intervals; robustness brackets are 95% bootstrap intervals clustered by prompt. All values are percentages; higher is better. Best results are bolded .

Router Policy	Assignment	$\alpha=1.0\%$	$\alpha=0.1\%$	PPL $\leq 18.25$	DIAA	DIPPER	Compliance	Failures (/500)
	Rule	Clean Detection		Quality	Robustness ( $\alpha=0.1\%$ )		Policy Action	Routing
gpt-5-nano (low reasoning)	0 $70.6$	$87.5$	$84.5$	$91.0$	$10.2$	$16.4$	0 $75.0$	36
gpt-5.4-nano (high reasoning)	100.0	98.0	97.5	98.0	13.8	17.0	100.0	0 0

Table 5: Impact of deployment monitor. Clean detection is averaged over watermark-required rules (

n=400

); robustness covers 100 prompts under paraphrase attack at

\alpha=0.1\%

; quality measures PPL

\leq 18.25

across advice and deterministic requests (

n=200

). Rates are percentages; best results are bolded . Evasion probes and a routing rerun are in Appendix C.6 .

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Rule (priority)	Reasoning verifier (C-KGW)	Random-search verifier
Misuse (robustness over quality)	$(0.5,6,4,\texttt{min})$	$(0.4109,4,2,\texttt{min})$
Editing (exempt)	NoWM	NoWM
Advice (quality, low distortion)	$(0.5,4,1,\texttt{additive})$	$(0.5603,5,6,\texttt{time})$
Deterministic (quality, detection)	$(0.5,4,1,\texttt{additive})$	$(0.6056,27,1,\texttt{skip})$
General (minimize distortion)	$(0.5,4,1,\texttt{additive})$	$(0.5763,6,6,\texttt{min})$

Appendix

Table 6: Configurations stored per rule. Tuples are

(\gamma,\delta,h,f)

: green-list fraction, logit bias, context length, and seeding function. Rules are listed in precedence order. Reasoning-verifier configurations for advice, deterministic answers, and general generation are Reference-Passed ; misuse is Best-Effort (Table 3 ). Random-search

\gamma

is rounded for display only.

Detector / Use	$(\gamma,h,f)$	$\eta_{\alpha}$	Observed FPR	$\eta_{\alpha}$	Observed FPR
		Nominal $\alpha=1.0\%$		Nominal $\alpha=0.1\%$
Fixed KGW A	$(0.25,3,\texttt{time})$	2.531	$0.940\;_{[0.691,\,1.248]}$	3.408	$0.080\;_{[0.022,\,0.205]}$
Fixed KGW B	$(0.5,1,\texttt{time})$	2.776	$1.060\;_{[0.795,\,1.384]}$	3.842	$0.160\;_{[0.069,\,0.315]}$
Reasoning: non-misuse	$(0.5,1,\texttt{additive})$	2.776	$1.060\;_{[0.795,\,1.384]}$	3.842	$0.160\;_{[0.069,\,0.315]}$
Reasoning: misuse	$(0.5,4,\texttt{min})$	2.371	$1.040\;_{[0.778,\,1.362]}$	3.208	$0.140\;_{[0.056,\,0.288]}$
Random search: deterministic	$(0.6056,1,\texttt{skip})$	2.967	$1.000\;_{[0.743,\,1.316]}$	4.111	$0.140\;_{[0.056,\,0.288]}$

Appendix

Table 7: Measured null-reference FPRs, not an independent final audit. Each row tests 5,000 unwatermarked texts disjoint from threshold calibration; their feedback was reused during configuration selection.

\eta_{\alpha}

is the calibrated detection threshold at nominal FPR

\alpha

. Brackets give two-sided 95% Clopper–Pearson intervals; these are descriptive, not guarantees after adaptive selection. The provider’s looser 1% cap is a separate requirement. Detector tuples are

(\gamma,h,f)

with fixed key and tokenizer; generation bias

\delta

does not affect the score. Random-search

\gamma

is rounded for display only. The reasoning verifier’s three non-misuse rules share one detector, which coincides with Fixed KGW B’s because for

h=1

every seeding function reduces to the preceding token. Rates are percentages.

	Robustness ( $\alpha=1.0\%$ )
Method	DIAA	DIPPER
Fixed KGW A	$\phantom{0}8.6\;_{[5.6,\,12.2]}$	$11.8\;_{[8.6,\,15.4]}$
Fixed KGW B	$\phantom{0}8.8\;_{[5.8,\,12.0]}$	$19.0\;_{[14.8,\,23.4]}$
Random-search verifier	$26.6\;_{[20.4,\,33.0]}$	$28.2\;_{[23.0,\,33.6]}$
Reasoning verifier (C-KGW, ours)	$\mathbf{27.8}\;_{[21.8,\,34.4]}$	$\mathbf{30.8}\;_{[25.6,\,36.2]}$

Appendix

Table 8: Robustness at nominal

\alpha=1\%

. Post-paraphrase detection on the 100 robustness-required prompts (5 attacks/response), under the same generations, attacks, and routing as Table 2 . Brackets show 95% percentile-bootstrap intervals, clustered by prompt. All values are percentages; higher is better. Best results are bolded .

Nominal FPR	Attack	Reasoning	Random search	Difference
$0.1\%$	DIAA	13.8	12.2	$+1.6\;_{[-2.6,\,3.8]}$
	DIPPER	17.0	11.6	$\mathbf{+5.4}\;_{[0.6,\,10.2]}$
$1.0\%$	DIAA	27.8	26.6	$+1.2\;_{[-7.8,\,5.2]}$
	DIPPER	30.8	28.2	$+2.6\;_{[-3.8,\,9.2]}$

Appendix

Table 9: Paired robustness differences, reasoning verifier (C-KGW) minus random-search verifier. Both methods are evaluated on the same 100 robustness-required prompts (5 attacks/response). Brackets show 95% paired percentile-bootstrap intervals over source prompts (10,000 replicates), keeping each prompt’s attack repetitions together; attack failures count as misses. Rates are percentages; differences are in percentage points.

Panel of Figure 3 — Figure 3: Configuration refinement for the misuse rule. Results are measured on the 10-prompt reference set at nominal $\alpha=0.1\%$ against the gates detection $\geq 0.95$ , quality $\geq 0.90$ , and robustness $\geq 0.50$ ; ✓ / ✗ mark whether each is met. Robustness counts detections over $50$ attacked responses (10 prompts $\times$ 5 attacks), taking the worse of DIAA and DIPPER.

Panel of Figure 4 — Figure 4: Deployment routing by the lightweight monitor. Examples 1 and 2 share a medical subject but differ in the requested operation; Example 3 shows an omitted applicable rule. Prompts and rationales are verbatim; rule identifiers are mapped to the names used in Appendix B.4 .

Probe set	Expected route	$n$	Correct route (%)
Misuse framed as editing: corpus prompts	Misuse $\rightarrow$ WM	8	$100.0\;_{[63.1,\,100.0]}$
Misuse framed as editing: generated probes	Misuse $\rightarrow$ WM	42	$100.0\;_{[91.6,\,100.0]}$
Misuse framed as editing: all	Misuse $\rightarrow$ WM	50	$\mathbf{100.0}\;_{[92.9,\,100.0]}$
Editing-only controls (corpus)	Editing $\rightarrow$ NoWM	50	$98.0\;_{[89.4,\,99.9]}$

Appendix

Table 10: Exemption-evasion pilot ( gpt-5.4-nano , high reasoning). Under first-applicable precedence, misuse precedes editing, so misuse requests framed as editing should be routed to the misuse rule and watermarked. Brackets give two-sided 95% Clopper–Pearson intervals. No routing failures occurred.

Monitor	Prompts	$n$	Correct rule (%)	Correct decision (%)	Failures
gpt-5-nano (low)	Overlapping	97	$72.2\;_{[62.1,\,80.8]}$	93.8	4
	Single-rule	403	$70.2\;_{[65.5,\,74.6]}$	88.6	32
	All	500	$70.6\;_{[66.4,\,74.6]}$	89.6	36
gpt-5.4-nano (high)	Overlapping	97	$95.9\;_{[89.8,\,98.9]}$	97.9	0
	Single-rule	403	$97.3\;_{[95.2,\,98.6]}$	99.0	0
	All	500	$97.0\;_{[95.1,\,98.3]}$	98.8	0

Appendix

Table 11: Routing on overlapping and single-rule test prompts. Overlapping prompts are annotated with more than one applicable rule. gpt-5-nano results come from the end-to-end run in Table 5 ; gpt-5.4-nano results come from a separate routing-only rerun with the same instruction, frozen policy, and enforcer. Decision accuracy is the resulting WM/NoWM decision over all prompts, distinct from the editing-only compliance in Table 5 . Routing failures count as incorrect; brackets give two-sided 95% Clopper–Pearson intervals for rule assignment.

Explore similar work

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks
Aug 13, 2026Xiaoyan Feng, Yanjun Zhang, He Zhang +2Large Language Model Watermarks Tamper Localization
Griffith University
Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs
May 28, 2026Zhihao Wu, Gracia Gong, Qinglin Zhu +2Large Language Model Watermarks Watermarks
Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.
TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection
May 12, 2026Tom Sander, Hongyan Chang, Tomáš Souček +10Large Language Model Watermarks Watermarking
FAIR, Meta Superintelligence Labs

Aug 13, 2026, cs.CRJ/K move · Enter open · S save

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

Xiaoyan Feng, Yanjun Zhang, He Zhang, Leo Yu Zhang+1

Griffith University

Large Language Model Watermarks Tamper Localization Machine-Generated Text Detection Attacker Large Language Model Provenance Spoofing+1

Open paper AskPDF arXiv

Watermarking LLM-generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co-embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round-allocation pattern controls the trade-off between the two signals. At detection, their scores form a two-dimensional space supporting three decisions: Intact, Tampered, and No-Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper-detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three-state detection requires a well-defined notion of intactness, co-embedding of the two signals, and complementary sensitivity to edits.

Abstract

Explore similar work

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection