ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models

Xiaopu Wang; Runze Li

cs.CROct 10, 2026

ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models

Authors: Xiaopu Wang, Runze Li

Abstract

As watermarking of LLM-generated text enters deployment, users increasingly need to check text whose source is unknown. Existing detectors read the watermark through a specific tokenizer or embedding pipeline, and even if all providers adopted the same watermarking method, differences in these representations would leave their watermarks incompatible, and the text alone does not reveal which representation produced it. We propose ByteMark, a unified watermarking scheme that defines its signal on the UTF-8 bytes of published text. Models with different tokenizers embed this signal under one public specification and key, and a single detector verifies the text from the text and key alone. When the tokenizer or embedding model of a baseline detector is replaced, its detection degrades sharply, whereas ByteMark, which uses neither, retains its detection rate; ByteMark also remains detectable when participating models continue or rewrite the text.

Figures & tables

Panel of Figure 1 — Figure 1: LetterMark scoring the candidate token tea after context letters $c_{1}c_{2}c_{3}c_{4}$ (top) and detecting the mark (bottom). The blue window holds the last $h=4$ letters, and its keyed hash selects the green list for the next letter; after each check the letter is appended and the window slides by one. Two of the three letters are green, so $R(\texttt{tea})=2/3$ . The verifier repeats the same scan on the published text without a tokenizer.

Panel of Figure 2 — Figure 2: Each baseline detector recovers the watermark only with the representation of the generating source, whereas one ByteMark detector serves all three sources.

Method	Observed	Independent
KGW	0.0580	0.0585
SynthID	0.0580	0.0585
SIR	0.0537	0.0585
EXP	0.0563	0.0585
ITS	0.0573	0.0585

Table 4: Same-pool empirical false-positive rate of an uncorrected search that flags a human text when any of

K=6

candidate tokenizers exceeds its own threshold at level

\alpha=1\%

. Independent candidates would give

1-(1-\alpha)^{K}\approx 5.85\%

; identical rejection events would give

\alpha

. Bonferroni correction tests each candidate at

\alpha/K\approx 0.167\%

Panel of Figure 3 — Figure 3: Detection across model transitions. Left: mean local $z$ in a sliding window of five tokens along the C4 relay; dashed lines mark model switches. Right: ByteMark AUROC after rewriting by participating models of Pythia-1.4B completions.

Method	Final tok/s	Relative (%)	Generated / final
Unwatermarked	63.82	100.0	1.00
ByteMark	62.19	97.4	1.00
SemStamp	1.73	2.7	35.38
k-SemStamp	6.17	9.7	10.10
SimMark	0.49	0.8	119.36
AliMark ∗	18.22	28.6	100.68

Table 5: Generation efficiency with OpenLLaMA-3B on 50 C4 texts. Relative is the share of the unwatermarked rate (63.82 tok/s). ∗ Different backend (vLLM). Appendix J.1 gives the measurement conditions.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Tokenizer	IDs	Tokenizer	IDs
xglm-564M	256,008	deepseek-llm-7b-base	100,015
bloom-560m	250,680	Jamba-v0.1	65,536
MiniMax-M2	200,054	falcon-7b	65,024
gpt-oss-120b	200,019	gpt-j-6b	50,400
Ling-1T	157,153	phi-2	50,295
Seed-OSS-36B-Base	155,121	OLMoE-1B-7B-0924	50,280

Appendix

Table 6: Token-to-byte mapping coverage for the 35 surveyed causal-language-model vocabularies. Every vocabulary ID has a defined byte contribution (100% UTF-8 byte-interface compatibility).

Panel of Table 8 — Table 8: KGW: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 9 — Table 9: SynthID: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 10 — Table 10: SIR: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 11 — Table 11: EXP: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Panel of Table 12 — Table 12: ITS: matched versus replacement tokenizers. Each cell shows AUROC (top) and TPR (bottom). Cells with TPR below $0.2$ are shaded pale yellow.

Method	Detection encoder	Relation	AUROC	TPR
SimMark	instructor-large	matched	0.9889	0.9178
	semstamp-c4-sbert	replacement	0.3448	0.0080
	instructor-base	replacement	0.9051	0.3006
	mpnet-base-v2	replacement	0.2982	0.0240
	MiniLM-L6-v2	replacement	0.3780	0.0341
SemStamp	semstamp-c4-sbert	matched	0.9996	0.9914

Appendix

Table 13: Detection-encoder replacement on C4 with each method’s author generation model. The matched embedding model is the one used at generation. TPR cells below

0.2

are shaded pale yellow.

Method	Data	Detection encoder	Relation	AUROC	TPR
SimMark	C4	instructor-large	matched	0.9733	0.6213
	Wiki	instructor-large	matched	0.9968	0.9299
	C4	semstamp-c4-sbert	replacement	0.4701	0.0021
	C4	instructor-base	replacement	0.8592	0.1444
	C4	mpnet-base-v2	replacement	0.2650	0.0084
	C4	MiniLM-L6-v2	replacement	0.2492	0.0167

Appendix

Table 14: Semantic methods with Pythia-1.4B as the generation model and author watermark parameters. On C4 the detection encoder is replaced; on Wiki only the matched embedding model is evaluated. The matched embedding model is the one used at generation. TPR cells below

0.2

are shaded pale yellow.

Method	Parrot	DIPPER	Mistral-7B
ByteMark (participating)	0.9985	0.9998	0.9888
ByteMark (non-participating)	0.9690	0.7499	0.8348
KGW	0.9791	0.8635	0.8990
SynthID	0.9797	0.7036	0.7920
EXP	0.9643	0.7327	0.8237
ITS	0.5281	0.5459	0.6273

Appendix

Table 16: AUROC after rewriting C4/Pythia-1.4B completions with three rewriters. The rewriter adds no watermark except in the ByteMark (participating) row, where it re-embeds the ByteMark watermark.

				Realized FPR
Corpus	Statistic	Mean $\bar{z}$	SD $s_{z}$	$z>2$	$z>3$	$z>4$
C4	Deduplicated	+0.0230	0.9863	0.0202	0.0012	0.0000
	All occurrences	+0.0190	1.0332	0.0272	0.0020	0.0000
Wiki	Deduplicated	+0.0250	0.9735	0.0216	0.0008	0.0000
	All occurrences	+0.0234	1.0005	0.0244	0.0004	0.0000
LFQA	Deduplicated	-0.0015	1.0117	0.0244	0.0020	0.0000

Appendix

Table 19: Detection-score moments on human text and the realized false-positive rate at the normal-approximation thresholds

z>2

z>3

, and

z>4

, whose nominal rates are 2.28%, 0.135%, and 0.003%.

Texts	Count	Bytes	Distinct inputs	Median $z(x)$ [range]
Watermarked	50	\tl_set:Ne 21326	\tl_set:Ne 20866	4.81 [2.73, 7.13]
Human	50	\tl_set:Ne 22206	\tl_set:Ne 21359	0.12 [-2.16, 2.38]

Appendix

Table 20: Detector agreement on 100 texts from the C4/OpenLLaMA experiment (AES-CMAC,

h=8

). Top: the replayed texts. Bottom: for each compared quantity, the percentage of texts or byte positions at which the JavaScript or C++ output is identical to that of the Python detector. All comparisons are exact, without numerical tolerance.

Explore similar work

Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text
Oct 9, 2026Tung-Ling LiLLM Watermarking Robust Watermarking
Independent Researcher
Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs
May 28, 2026Zhihao Wu, Gracia Gong, Qinglin Zhu +2Watermark Removal LLM Watermarking
Department of Informatics, King’s College London, UK · Department of Mathematics, Imperial College London, UK · Department of Statistics, University of Warwick, UK.
Language Model Fingerprinting Requires Rethinking Watermark Teachers
Oct 3, 2026Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1Language Model Fingerprinting LLM Watermarking
Pohang University of Science and Technology · University of Washington

Oct 9, 2026J/K move · Enter open · S save

Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text

Tung-Ling Li

Independent Researcher

LLM Watermarking Robust Watermarking Robustness of Machine-Generated Text Detection

Open paper AskPDF arXiv

We introduce Tokenization-Invariant Watermarking (TI-WM), a method that embeds a watermark during token generation but keys and scores it on canonicalized UTF-8 bytes. The detector does not invoke the tokenizer. Canonicalizer-preserving edits leave its score unchanged; other localized canonical-byte edits affect a bounded number of scoring windows. Across three fixed keys and 128 prompts per key and model, a deterministic white-box attack at a 5% word-edit budget leaves mean attacked-AUC 0.530 on Qwen3-8B and 0.664 on Gemma 4 E4B, compared with 0.410 and 0.489 for Unigram with detection-side deletion. These operating points are not jointly matched on quality and clean detectability. Bias sweeps show model-dependent distortion costs, and shared-rule controls support a locality interpretation without establishing a unique advantage of bytes. Visible insertion outside the canonicalizer's deletion set defeats the default design. Alphabetic filtering closes that channel but does not resolve source shift or calibrated detection power. TI-WM thus provides a concrete construction with local scoring guarantees and measured attack-ranking gains, not a general robustness or low-false-positive-rate deployment guarantee.

Abstract

Explore similar work

Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text

Linear Ensembles Wash Away Watermarks: On the Fragility of Distributional Perturbations in LLMs

Language Model Fingerprinting Requires Rethinking Watermark Teachers