Watermarkability: Measuring and Improving Language-Model Compatibility with Logit-Based Watermarks
Authors: Zewei Deng, Mohamed Seif, Liyan Xie
Organizations: Department of Industrial and Systems Engineering, University of Minnesota · Department of Computer Science and Engineering, Oakland University · Princeton University
Language-model watermarks can help identify model-generated text, encode provenance information, and detect post-generation edits. A broad class of logit-based watermarks increases the logits of a designated token set at each decoding step. Because a base model's native probability mass on this set varies across contexts, models, and watermark rules, the same logit bias can yield different adherence rates and increases in perplexity (PPL). We introduce watermarkability to characterize the compatibility between a model and the token sets requested by a watermark. At a target mass τ, we quantify this property through a watermarkability cost: the expected minimum KL divergence from the base-model distribution required to assign probability at least τ to the requested set. A lower cost means that the model is more watermarkable for that request distribution. To reduce this cost, we propose a two-stage method. In the first stage, we train a target-set-conditioned low-rank adapter on unions drawn from a 16-way vocabulary partition to increase the requested set's probability mass. In the second stage, a closed-form controller applies the smallest remaining uniform logit bias needed to reach the target mass. We evaluate the method on six watermark schedules using OPT-125M and Qwen3-8B. Across the 12 model-schedule pairs, the pre-adaptation watermarkability cost correlates with the log-PPL increase under a near-hard fixed-bias baseline (pooled Pearson r=0.929). For every schedule, at least 99.80% of sampled tokens fall in the target set requested at their decoding step. At this reliability, the adapter and controller reduce average per-schedule prompt-conditional PPL by 46.3% on OPT-125M and 5.2% on Qwen3-8B relative to the fixed-bias baseline.
Figures & tables
Figure 1: Two-stage watermark realization. The target-conditioned LoRA redistributes probability toward contextually plausible tokens inside the requested set. The controller then applies a common residual logit shift, preserving the adapted token scores while bringing aggregate target mass from Mtθ to τ . Aligned illustrative gauges compare native, adapted, and controlled target mass.
Watermarks
Native bucket partition
Classes
Bucket labels
Vocabulary share
Alternating binary
2
Symbol 0 / Symbol 1
1/2 , 1/2
Unigram, Grouped-KGW50
Target / Complement
1/2 , 1/2
Grouped-KGW25
Target / Complement
1/4 , 3/4
CW-ABCD
4
A / B / C / D
1/4 each
Anchor-ECC (quality variant)
3
Payload 0 / 1 / Boundary anchor
7/16 , 7/16 , 1/8
Table 1: Native bucket structures of the evaluated watermarks, grouped by the number of bucket classes. Vocabulary shares follow the bucket-label order.
Figure 2: One model-specific 16-bucket partition supports fixed and dynamic target-set compositions. Structured schedules regroup base buckets into symbol sets; dynamic schedules recompute Jt from the prefix and key. Highlighted buckets show one generation step.
Table 3: Held-out results after generic composition-pool training. Δ is the relative PPL reduction from fixed δ=20 to LoRA+Controller; positive is better. The Mean-row Δ averages the six per-rule relative reductions.
Model
Method
PPL
Adherence (%)
Mean residual bias α
OPT-125M
Controller
19.92
99.78
4.78
LoRA only
5.66
46.43
—
LoRA + controller
11.77
99.83
3.64
Qwen3-8B
Controller
15.57
99.76
5.09
LoRA only
5.49
44.34
—
LoRA + controller
15.32
99.82
4.11
Table 4: Component-level macro results; α is the mean residual bias over active decoding steps.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Rule
Target composition
Schedule
Dynamic
ECC
7:7:2 buckets
feasible 7-bit payload + boundary
No
Binary
8:8 buckets
alternating symbols
No
CW-ABCD
four 4-bucket sets
ACADBCBD
No
Unigram
fixed 8-of-16
constant green set
No
Grouped-KGW50
8-of-16
prefix/key-seeded union
Yes
Grouped-KGW25
4-of-16
prefix/key-seeded union
Yes
Appendix
Table 5: Watermark schedules used only for held-out evaluation. “Dynamic” means the exact base-bucket union changes with the generated prefix.
Target size
Observed
Possible
Coverage
2-of-16
120
120
100.0%
4-of-16
1,820
1,820
100.0%
7-of-16
11,440
11,440
100.0%
8-of-16
12,870
12,870
100.0%
Appendix
Table 6: Distinct base-bucket unions covered by the generic composition curriculum.
Fixed δ=20
Controller
LoRA only
LoRA+Controller
Rule
PPL
Adh.
PPL
Adh.
PPL
Adh.
PPL
Adh.
ECC
26.57
1.0000
26.38
0.9972
5.91
0.4675
20.73
0.9980
Binary
11.95
1.0000
11.87
0.9979
4.99
0.5952
4.37
0.9983
CW-ABCD
26.03
1.0000
26.03
0.9974
6.84
0.3183
13.00
0.9980
Unigram
7.76
1.0000
8.16
0.9980
5.52
0.4969
3.22
0.9989
Grouped-KGW50
16.06
1.0000
15.94
0.9980
4.68
0.5935
7.50
0.9982
Appendix
Table 7: Complete OPT-125M evaluation after generic composition-pool training. Adherence is shown as a fraction.
Fixed δ=20
Controller
LoRA only
LoRA+Controller
Rule
PPL
Adh.
PPL
Adh.
PPL
Adh.
PPL
Adh.
ECC
17.92
0.9994
17.80
0.9972
5.38
0.4539
20.19
0.9983
Binary
8.37
0.9997
8.28
0.9975
4.61
0.5444
7.52
0.9982
CW-ABCD
22.15
0.9998
22.91
0.9978
7.09
0.2901
20.38
0.9983
Unigram
7.40
0.9999
7.47
0.9982
4.40
0.5280
5.43
0.9981
Grouped-KGW50
10.11
0.9998
10.33
0.9977
4.62
0.5394
9.69
0.9980
Appendix
Table 8: Complete Qwen3-8B evaluation after generic composition-pool training. Adherence is shown as a fraction.
Fixed δ=20
Controller
LoRA only
LoRA+Controller
Rule
PPL
Adh.
PPL
Adh.
PPL
Adh.
PPL
Adh.
ECC
26.57
1.0000
26.38
0.9972
7.55
0.5590
20.08
0.9977
Binary
11.95
1.0000
11.87
0.9979
4.73
0.7694
4.33
0.9989
CW-ABCD
26.03
1.0000
26.03
0.9974
8.26
0.3867
12.73
0.9985
Unigram
7.76
1.0000
8.16
0.9980
4.05
0.7324
3.23
0.9991
Grouped-KGW50
16.06
1.0000
15.94
0.9980
6.06
0.6509
7.82
0.9984
Appendix
Table 9: Complete corrected schedule-aware OPT-125M ablation. Adherence is shown as a fraction.
Fixed δ=20
Controller
LoRA only
LoRA+Controller
Rule
PPL
Adh.
PPL
Adh.
PPL
Adh.
PPL
Adh.
ECC
17.92
0.9994
17.80
0.9972
6.92
0.4681
21.38
0.9981
Binary
8.37
0.9997
8.28
0.9975
5.47
0.5833
7.07
0.9984
CW-ABCD
22.15
0.9998
22.91
0.9978
9.75
0.3160
19.63
0.9986
Unigram
7.40
0.9999
7.47
0.9982
5.40
0.5929
4.59
0.9987
Grouped-KGW50
10.11
0.9998
10.33
0.9977
5.66
0.5724
9.62
0.9983
Appendix
Table 10: Complete schedule-aware Qwen3-8B ablation. Adherence is shown as a fraction.