ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models

Xiaopu Wang; Runze Li

cs.CROct 10, 2026

ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models

Authors: Xiaopu Wang, Runze Li

Abstract

As watermarking of LLM-generated text enters deployment, users increasingly need to check text whose source is unknown. Existing detectors read the watermark through a specific tokenizer or embedding pipeline, and even if all providers adopted the same watermarking method, differences in these representations would leave their watermarks incompatible, and the text alone does not reveal which representation produced it. We propose ByteMark, a unified watermarking scheme that defines its signal on the UTF-8 bytes of published text. Models with different tokenizers embed this signal under one public specification and key, and a single detector verifies the text from the text and key alone. When the tokenizer or embedding model of a baseline detector is replaced, its detection degrades sharply, whereas ByteMark, which uses neither, retains its detection rate; ByteMark also remains detectable when participating models continue or rewrite the text.

Figures & tables

Panel of Figure 1 — Figure 1: LetterMark scoring the candidate token tea after context letters $c_{1}c_{2}c_{3}c_{4}$ (top) and detecting the mark (bottom). The blue window holds the last $h=4$ letters, and its keyed hash selects the green list for the next letter; after each check the letter is appended and the window slides by one. Two of the three letters are green, so $R(\texttt{tea})=2/3$ . The verifier repeats the same scan on the published text without a tokenizer.

Panel of Figure 2 — Figure 2: Each baseline detector recovers the watermark only with the representation of the generating source, whereas one ByteMark detector serves all three sources.

Method	Observed	Independent
KGW	0.0580	0.0585
SynthID	0.0580	0.0585
SIR	0.0537	0.0585
EXP	0.0563	0.0585
ITS	0.0573	0.0585

Table 4: Same-pool empirical false-positive rate of an uncorrected search that flags a human text when any of

K=6

candidate tokenizers exceeds its own threshold at level

\alpha=1\%

. Independent candidates would give

1-(1-\alpha)^{K}\approx 5.85\%

; identical rejection events would give

\alpha

. Bonferroni correction tests each candidate at

\alpha/K\approx 0.167\%

Panel of Figure 3 — Figure 3: Detection across model transitions. Left: mean local $z$ in a sliding window of five tokens along the C4 relay; dashed lines mark model switches. Right: ByteMark AUROC after rewriting by participating models of Pythia-1.4B completions.

Method	Final tok/s	Relative (%)	Generated / final
Unwatermarked	63.82	100.0	1.00
ByteMark	62.19	97.4	1.00
SemStamp	1.73	2.7	35.38
k-SemStamp	6.17	9.7	10.10
SimMark	0.49	0.8	119.36
AliMark ∗	18.22	28.6	100.68

Table 5: Generation efficiency with OpenLLaMA-3B on 50 C4 texts. Relative is the share of the unwatermarked rate (63.82 tok/s). ∗ Different backend (vLLM). Appendix J.1 gives the measurement conditions.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Tokenizer	IDs	Tokenizer	IDs
xglm-564M	256,008	deepseek-llm-7b-base	100,015
bloom-560m	250,680	Jamba-v0.1	65,536
MiniMax-M2	200,054	falcon-7b	65,024
gpt-oss-120b	200,019	gpt-j-6b	50,400
Ling-1T	157,153	phi-2	50,295
Seed-OSS-36B-Base	155,121	OLMoE-1B-7B-0924	50,280

Appendix

Table 6: Token-to-byte mapping coverage for the 35 surveyed causal-language-model vocabularies. Every vocabulary ID has a defined byte contribution (100% UTF-8 byte-interface compatibility).

Panel of Table 8 — Table 8: KGW: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 9 — Table 9: SynthID: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 10 — Table 10: SIR: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 11 — Table 11: EXP: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 12 — Table 12: ITS: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Method	Detection encoder	Relation	AUROC	TPR
SimMark	instructor-large	matched	0.9889	0.9178
	semstamp-c4-sbert	replacement	0.3448	0.0080
	instructor-base	replacement	0.9051	0.3006
	mpnet-base-v2	replacement	0.2982	0.0240
	MiniLM-L6-v2	replacement	0.3780	0.0341
SemStamp	semstamp-c4-sbert	matched	0.9996	0.9914

Appendix

Table 13: Detection-encoder replacement on C4 with each method’s author generation model. The matched embedding model is the one used at generation. TPR cells below

0.2

are shaded pale yellow.

Method	Data	Detection encoder	Relation	AUROC	TPR
SimMark	C4	instructor-large	matched	0.9733	0.6213
	Wiki	instructor-large	matched	0.9968	0.9299
	C4	semstamp-c4-sbert	replacement	0.4701	0.0021
	C4	instructor-base	replacement	0.8592	0.1444
	C4	mpnet-base-v2	replacement	0.2650	0.0084
	C4	MiniLM-L6-v2	replacement	0.2492	0.0167

Appendix

Table 14: Semantic methods with Pythia-1.4B as the generation model and author watermark parameters. On C4 the detection encoder is replaced; on Wiki only the matched embedding model is evaluated. The matched embedding model is the one used at generation. TPR cells below

0.2

are shaded pale yellow.

Method	Parrot	DIPPER	Mistral-7B
ByteMark (participating)	0.9985	0.9998	0.9888
ByteMark (non-participating)	0.9690	0.7499	0.8348
KGW	0.9791	0.8635	0.8990
SynthID	0.9797	0.7036	0.7920
EXP	0.9643	0.7327	0.8237
ITS	0.5281	0.5459	0.6273

Appendix

Table 16: AUROC after rewriting C4/Pythia-1.4B completions with three rewriters. The rewriter adds no watermark except in the ByteMark (participating) row, where it re-embeds the ByteMark watermark.

				Realized FPR
Corpus	Statistic	Mean $\bar{z}$	SD $s_{z}$	$z>2$	$z>3$	$z>4$
C4	Deduplicated	+0.0230	0.9863	0.0202	0.0012	0.0000
	All occurrences	+0.0190	1.0332	0.0272	0.0020	0.0000
Wiki	Deduplicated	+0.0250	0.9735	0.0216	0.0008	0.0000
	All occurrences	+0.0234	1.0005	0.0244	0.0004	0.0000
LFQA	Deduplicated	-0.0015	1.0117	0.0244	0.0020	0.0000

Appendix

Table 19: Detection-score moments on human text and the realized false-positive rate at the normal-approximation thresholds

z>2

z>3

, and

z>4

, whose nominal rates are 2.28%, 0.135%, and 0.003%.

Texts	Count	Bytes	Distinct inputs	Median $z(x)$ [range]
Watermarked	50	\tl_set:Ne 21326	\tl_set:Ne 20866	4.81 [2.73, 7.13]
Human	50	\tl_set:Ne 22206	\tl_set:Ne 21359	0.12 [-2.16, 2.38]

Appendix

Table 20: Detector agreement on 100 texts from the C4/OpenLLaMA experiment (AES-CMAC,

h=8

). Top: the replayed texts. Bottom: for each compared quantity, the percentage of texts or byte positions at which the JavaScript or C++ output is identical to that of the Python detector. All comparisons are exact, without numerical tolerance.

Explore similar work

Oct 9, 2026

Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text

We introduce Tokenization-Invariant Watermarking (TI-WM), a method that embeds a watermark during token generation but keys and scores it on canonicalized UTF-8 bytes. The detector does not invoke the tokenizer. Canonicalizer-preserving edits leave its score unchanged; other localized canonical-byte edits affect a bounded number of scoring windows. Across three fixed keys and 128 prompts per key and model, a deterministic white-box attack at a 5% word-edit budget leaves mean attacked-AUC 0.530 on Qwen3-8B and 0.664 on Gemma 4 E4B, compared with 0.410 and 0.489 for Unigram with detection-side deletion. These operating points are not jointly matched on quality and clean detectability. Bias sweeps show model-dependent distortion costs, and shared-rule controls support a locality interpretation without establishing a unique advantage of bytes. Visible insertion outside the canonicalizer's deletion set defeats the default design. Alphabetic filtering closes that channel but does not resolve source shift or calibrated detection power. TI-WM thus provides a concrete construction with local scoring guarantees and measured attack-ranking gains, not a general robustness or low-false-positive-rate deployment guarantee.

Tung-Ling Li

Independent Researcher

LLM Watermarking Robust Watermarking Robustness of Machine-Generated Text Detection

Ask PDF

May 28, 2026

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

Watermarking embeds statistical signatures in AI-generated text for detection and attribution. We reveal a fundamental vulnerability: when users access multiple models (today's reality), watermarks trivially fail. Watermarks perturb output distributions away from the original, and in competitive markets, these perturbations are typically independent across providers. We theoretically prove that averaging output probability distributions recovers the unwatermarked distribution with up to a second-order error term. Empirically, simply averaging 3-5 models cancels out these perturbations. We introduce WASH (Watermark Attenuation via Statistical Hybridisation), which solves practical challenges in ensemble generation: vocabulary misalignment and tokenisation differences across heterogeneous models. Experiments across six watermarking schemes and three LLMs show that averaging across 3 models suppresses detection z-scores from 5-300 to below 2 (below the detection threshold of 4) and reduces TPR at 5% FPR to below 50%, while improving quality by 27.5% and running 6 times faster than the best baseline on the long sequence generation. Our results suggest that robust AI-text detection via watermarking requires either accepting this fundamental vulnerability or unprecedented coordination among model providers.

Zhihao Wu, Gracia Gong, Qinglin Zhu +2

Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.

Watermark Removal LLM Watermarking Robust Watermarking Language Model Ensembles Robustness of Machine-Generated Text Detection

Ask PDF

Oct 3, 2026

Language Model Fingerprinting Requires Rethinking Watermark Teachers

LLM fingerprinting via watermark distillation embeds a statistical watermark signal into model weights, enabling model owners to identify their models behind black-box APIs. Revisiting a recent protocol, we find that its utility evaluation understates text quality degradation in open-ended generation, favoring overly strong watermark teachers. Weakening the watermark improves text quality but sacrifices detectability. To move beyond this trade-off, we rethink whether text watermarks designed for verifying generated text are suitable distillation teachers for model fingerprinting. Such watermarks are typically designed to remain detectable from an individual output, limiting how sparse the watermark signal can be. In contrast, fingerprint verification can aggregate signal across queries, making sparser watermark signals viable. This raises a key question: where should the sparse signal be placed? We analyze signal placement through token surprisal and show that, even at comparable watermark strength, different placements can target tokens with different plausibility under the base model. This motivates near-tie restriction, which uses top-1-relative logit gaps to restrict the watermark bias to tokens close to the base model's top prediction. Across multiple models, near-tie improves detection--quality frontiers under deployment changes, preserves higher text quality across query budgets, and further improves existing watermarking schemes when combined with them.

Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1

Pohang University of Science and Technology · University of Washington

Language Model Fingerprinting LLM Watermarking Text Watermarking Language Model Distillation

Ask PDF