ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models

Yupeng Qiu; Han Fang; Ee-Chien Chang

cs.LGOct 19, 2026

ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models

Authors: Yupeng Qiu, Han Fang, Ee-Chien Chang

Organizations: School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui, China

Abstract

Large language model (LLM) watermarking operates on the next-token distribution that evolves during generation. In streaming generation, each sampled token becomes part of the text and affects subsequent distributions. Embedding therefore proceeds with a changing host, unlike classical watermarking, which adapts embedding to an existing host signal. To accommodate this difference, we formulate a novel embedding framework for LLM watermarking based on two principles. We first argue that embedding should be adaptive, retaining the state of previous sampling decisions to better guide subsequent choices. We further argue that embedding should be host-dependent, using the current LLM distribution to constrain both token selection and state updates. Guided by these principles and the two requirements of distribution preservation and robustness to text editing, we propose ClockMark. It combines adaptive and host-dependent embedding with message spreading, embedding the full payload in each watermarked token. Theoretically, we prove that ClockMark preserves the original LLM sequence distribution, thereby maintaining generation quality. Empirically, extensive experiments against 12 baselines demonstrate improved robustness to text editing, with gains of up to 16.08 percentage points in bit accuracy over the strongest tested baseline.

Figures & tables

Figure 1: ClockMark embedding. Each candidate countdown depends on all message bits and advances at its LLM probability. The sampler selects the first to finish, updates all active countdowns, and renews only the winner. Remaining countdowns are saved for repeated contexts. The indices $c$ and $v$ denote the context and candidate, and $n_{c,v}$ counts their pair selections.

Figure 2: ClockMark recovery and detection. The key reconstructs one initial vector for each of $N$ distinct adjacent token pairs. Their sum $S$ yields the message through coordinate signs (VSR) and a detection statistic through normalized energy $\|S\|^{2}/N$ (ED). A surviving $(A,B)$ preserves access to the same initial vector after deletion. Each pair is counted once.

Method	C4 (32 bits)				C4 (64 bits)
Method	PPL $\downarrow$	BA $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	BA $\uparrow$	AUC $\uparrow$	TPR $\uparrow$
No watermark	14.17	–	–	–	14.17	–	–	–
BalanceMarking	14.35	78.74	–	–	14.11	62.34	–	–
CredID	15.76	79.06	–	–	15.38	64.49	–	–
PURA	14.46	98.00	–	–	14.15	93.07	–	–
RSBH	15.47	56.16	–	–	14.82	51.68	–	–

Table 1: Clean Qwen results on C4. Bit accuracy (BA), area under the ROC curve (AUC), and true positive rate (TPR) at a 1% false positive rate (FPR) are percentages. Bold marks the best displayed BA, AUC, and TPR. Baselines without reported detection appear first. Dashes indicate unavailable or inapplicable results.

Method	Deletion
	10%			30%			50%
	BA	AUC	TPR	BA	AUC	TPR	BA	AUC	TPR
BalanceMarking	58.69	–	–	38.40	–	–	24.74	–	–
CredID	60.93	–	–	38.20	–	–	25.27	–	–
PURA	90.17	–	–	69.14	–	–	56.56	–	–
RSBH	53.60	–	–	51.31	–	–	50.87	–	–

Table 2: C4 robustness for 32 bit Qwen watermarks. Bit accuracy (BA), area under the ROC curve (AUC), and true positive rate (TPR) at a 1% false positive rate (FPR) are percentages. Bold marks the best displayed BA, AUC, and TPR. Baselines without reported detection appear first. Dashes indicate unavailable or inapplicable results.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Method	Embedding Setting
Biased	BalanceMarking	$\delta=1.5$ , 8-bit segments
	CredID	$\delta=1.5$ , 8-bit segments
	MOSAIC	$\delta=1.5$
	MPAC	$\delta=2$ , radix 4
	RSBH	$\delta=1$
	WaterMod	$\delta=2.5$

Appendix

Table 3: Embedding configurations of the twelve baselines, grouped by biased and unbiased embedding. Strength

\delta

and symbol parameter

m

follow the definitions of each baseline. SPC(5,4) is a single parity-check code with four data bits and one check bit.

Method	LFQA (32 bits)				LFQA (64 bits)
Method	PPL $\downarrow$	BA $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	BA $\uparrow$	AUC $\uparrow$	TPR $\uparrow$
No watermark	11.05	–	–	–	11.05	–	–	–
BalanceMarking	11.13	62.78	–	–	11.25	55.63	–	–
CredID	11.56	62.14	–	–	11.54	55.19	–	–
PURA	11.29	85.05	–	–	11.21	73.34	–	–
RSBH	11.56	52.62	–	–	11.61	50.92	–	–

Appendix

Table 4: Clean Qwen results on LFQA with 32 and 64 bit payloads. Bit accuracy (BA), area under the ROC curve (AUC), and true positive rate (TPR) at a 1% false positive rate (FPR) are percentages. Bold marks the best displayed BA, AUC, and TPR. Baselines without reported detection appear first. Dashes indicate unavailable or inapplicable results.

Method	LFQA (32 bits)				C4 (32 bits)
Method	PPL $\downarrow$	BA $\uparrow$	AUC $\uparrow$	TPR $\uparrow$	PPL $\downarrow$	BA $\uparrow$	AUC $\uparrow$	TPR $\uparrow$
No watermark	13.42	–	–	–	12.47	–	–	–
BalanceMarking	14.72	66.91	–	–	13.84	65.92	–	–
CredID	14.84	71.20	–	–	13.98	68.15	–	–
PURA	13.16	69.63	–	–	12.79	68.96	–	–
RSBH	14.28	57.96	–	–	13.20	56.21	–	–

Appendix

Table 5: Clean Gemma-2-9B results on LFQA and C4 with 32 and 64 bit payloads. Bit accuracy (BA), area under the ROC curve (AUC), and true positive rate (TPR) at a 1% false positive rate (FPR) are percentages. Bold marks the best displayed BA, AUC, and TPR. Baselines without reported detection appear first. Dashes indicate unavailable or inapplicable results.

Method	Deletion
	10%			30%			50%
	BA	AUC	TPR	BA	AUC	TPR	BA	AUC	TPR
BalanceMarking	53.77	–	–	37.35	–	–	25.26	–	–
CredID	53.81	–	–	37.83	–	–	24.41	–	–
PURA	72.51	–	–	58.13	–	–	53.54	–	–
RSBH	51.38	–	–	50.97	–	–	50.28	–	–

Appendix

Table 6: LFQA robustness for 32 bit Qwen watermarks. Bit accuracy (BA), area under the ROC curve (AUC), and true positive rate (TPR) at a 1% false positive rate (FPR) are percentages. Bold marks the best displayed BA, AUC, and TPR. Baselines without reported detection appear first. Dashes indicate unavailable or inapplicable results.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking
Dec 3, 2025Yizhou Zhao, Zhiwei Steven Wu, Adam BlockLLM Watermarking Robust Watermarking
University of Pennsylvania · Carnegie Mellon University · Columbia University
XMark: Reliable Multi-Bit Watermarking for LLM-Generated Texts
Apr 6, 2026Jiahao Xu, Rui Hu, Olivera Kotevska +1Multi-Bit Watermarking Text Watermarking
University of Nevada, Reno · Oak Ridge National Laboratory
Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks
Aug 13, 2026Xiaoyan Feng, Yanjun Zhang, He Zhang +2Data Provenance LLM Watermarking
Griffith University

Dec 3, 2025J/K move · Enter open · S save

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

Yizhou Zhao, Zhiwei Steven Wu, Adam Block

University of Pennsylvania · Carnegie Mellon University · Columbia University

LLM Watermarking Robust Watermarking Fine-Tuning

Open paper AskPDF arXiv

Language model watermarking schemes fall into two broad categories: inference-time methods, which modify the decoding process at generation time, and model-embedded methods, which encode a secret signal directly into the model weights. Inference-time watermarking methods incur additional inference overhead and are not applicable in the increasingly prevalent open-weight model settings. In contrast, model-embedded watermarks introduce no additional inference latency-generation uses the standard sampling pipeline-and are particularly well-suited to open-weight settings. However, existing model-embedded approaches such as GaussMark face a fundamental quality-detectability trade-off: achieving strong detection power typically requires weight perturbations that noticeably degrade generation quality. Our key insight is that regularizing toward a high-quality reference distribution decouples quality preservation from proximity to the base model, enabling a better quality-detectability trade-off. Building on this insight, we introduce MarkTune, a theoretically grounded on-policy fine-tuning framework that uses the GaussMark detection statistic as a reward while preserving generation quality through cross-entropy on high-quality human text or KL divergence to a stronger oracle model. Empirically, MarkTune substantially improves the quality-detectability frontier of GaussMark, approaching the detectability of strong inference-time schemes while preserving generation quality and downstream task performance. Marktune also remains robust under the evaluated text-editing and open-weight attacks and generalizes across datasets, retaining substantial detection power on corpora unseen during training. Code is available at https://github.com/zhyzmath/MarkTune-LLM-Watermarking.

Abstract

LLM Watermarking

Explore similar work

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

XMark: Reliable Multi-Bit Watermarking for LLM-Generated Texts

Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks