cs.AIOct 23, 2026

Watermarking Diffusion Language Models with Learned Foresight and Balanced Bands

Authors: Hyojun Kim, Hyeseon An, Yo-Sub Han

Organizations: Yonsei University, Seoul, Republic of Korea

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Green-red watermarks favor tokens from a green list that a secret key derives from the preceding tokens. Diffusion language models, however, often choose a token before its preceding tokens, and the token later shapes its neighbors' green lists. Prior work therefore tilts each choice to raise the expected number of green tokens at its own and its neighbors' positions. Building on this objective, we first learn two components that prior work keeps fixed: vocabulary bands that serve as green lists, separate competing candidates and keep the null distribution exact, and a foresight predictor that estimates how each candidate shifts its neighbors' predictions. Second, we count green tokens as the detector does, once per distinct context-token pair, so repetition earns nothing. On WaterBench with LLaDA-8B-Instruct, each learned component raises the z-score at equal distortion, and their gains are nearly additive. With a strong watermark, ours detects at least 96% of responses at a 1% false-positive rate while matching the LLM-judge score of unwatermarked text. Ours also detects more responses on Dream and as many or more on code and question answering without a significant loss in task accuracy.

Figures & tables

Figure 1: The two learned components at one masked position (illustrative tokens). (a) Learned bands spread the competing candidates over the bands, which a keyed hash may not. (b) Predicted post-placement beliefs let foresight favor charge , which is red but makes both neighbors green.
Figure 2: Overview of our watermark at a masked position jj (illustrative tokens and probabilities). Each module is learned offline from its own data (top), the tilt combines the own and foresight terms during generation (middle), and the detector needs only the key and the bands (bottom).
  TPR (%) ↑\uparrowlog-PPLJudgeRep.
Methodδ\delta@1%@0.1%↓\downarrow↑\uparrow↓\downarrow
No watermark–––1.2979.1219.3
dgMARK, greedy–92.784.21.5509.0716.2
dgMARK, top-3–92.384.31.5579.1215.2
DLM-KGW251.324.81.3169.1319.3
Ours269.544.01.3269.2918.2
Table 1: Main results on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence order. TPRs use calibrated thresholds, log-PPL is measured under Qwen3-8B, the judge is Gemma-4-12B-it (1–10), and Rep. is the share of responses with a repetition loop (§ 4 ). Bold marks the better of DLM-KGW and ours at the same δ\delta .
Figure 3: TPR@1% against log-PPL on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence order. Arrows mark our gain at the same δ\delta .
  δ=2\delta=2δ=3\delta=3δ=4\delta=4
  zˉ\bar{z}TPRlog-PPLJudgezˉ\bar{z}TPRlog-PPLJudgezˉ\bar{z}TPRlog-PPLJudge
PartitionForesight↑\uparrow@1% ↑\uparrow↓\downarrow↑\uparrow↑\uparrow@1% ↑\uparrow↓\downarrow↑\uparrow↑\uparrow@1% ↑\uparrow↓\downarrow↑\uparrow
 Current beliefs2.3549.01.3379.183.7884.51.3979.355.2794.51.5079.40
Keyed hashPredictor2.6159.51.3519.293.9886.51.4039.315.4595.71.4899.39
 None ( λ=0\lambda=0 )2.0639.31.3179.223.1170.71.3729.304.1589.51.4519.22
 Current beliefs2.7763.71.3089.244.2588.71.3919.335.6996.31.4829.25
Table 2: Crossing the two learned components on WaterBench-600 with LLaDA-8B-Instruct (same prompts, seeds and unit-aware score in every row). The keyed hash assigns bands by a keyed hash of the context and the token, as standard green-red watermarks do, and exact foresight † , a reference, re-runs the generator for each candidate. Metrics as in Table 1 . The shaded row is ours, and bold marks the best crossed cell at each δ\delta . Further metrics are in Table 17 and paired 95% CIs in Table 18 .
Figure 4: (a) Fidelity to exact foresight on 2,397 held-out decision states (Table 8 ). (b) Gain of the predictor in zˉ\bar{z} over current-belief foresight with learned bands on WaterBench-600, at the same δ\delta and at equal KL, with 95% CIs.
Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

PurposeSourcePrompts
Training
PartitionELI5, FiQA, AlpacaFarm1,200
PredictorELI5, FiQA, AlpacaFarm1,612
Code/QA (both)MBPP, MMLU-Pro, GSM8K1,791
Development
Context widthELI5, FiQA, AlpacaFarm150
Appendix
Table 5: Prompt sets. All training prompts are disjoint from the evaluation prompts. Those of the partition and the predictor come from the training splits of the WaterBench sources, and the development prompts from their development splits. Each predictor prompt is decoded once, at one of four strengths ( δ′∈{1,1.5,2,2.5}\delta^{\prime}\in\{1,1.5,2,2.5\} , about 400 prompts each). Code/QA (both): the partition and the predictor learned for code and QA (Table 4 , Appendix I ). QA: question answering. GPQA-D: GPQA-Diamond. Robustness: three seeds per prompt.
HyperparameterValueChoice
Bands BB ( γ=1/B\gamma=1/B )4prior work
Context width2 tokensscreened
Candidates tilted per positiontop-50prior work
Beliefs per context positiontop-4cost
Beliefs per dependenttop-8cost
Candidates with foresighttop-8cost
Appendix
Table 6: Hyperparameters of our watermark. Prior work: the value of Gloaguen et al. (2026) . Screened: chosen among a few values (Appendix H ). Cost: set to bound the cost. Fixed: fixed in advance.
Trainable parameters1.745B (8 layers) + 12.6M (adapter)
Adapter2-layer MLP, width 1,024, zero-initialized output
OptimizerAdamW, (β1,β2)=(0.9,0.98)(\beta_{1},\beta_{2})=(0.9,0.98) , weight decay 0.01
Learning rates2⋅10−52\cdot 10^{-5} (layers), 3⋅10−43\cdot 10^{-4} (adapter)
Schedule300 warm-up steps, cosine, 6 epochs planned
Batch12 decision states (8 candidates each) or 96 committed-candidate states
Gradient clipping1.0
Appendix
Table 7: Training of the foresight predictor.
ForesightTop-1Corr.R2R^{2}Argmax
Current beliefs26%0.39−- 2%28%
Predictor61%0.7349%54%
Top-1 token known–0.9168%55%
Appendix
Table 8: Fidelity of approximate foresight on 2,397 held-out decision states of LLaDA-8B-Instruct in its low-confidence order, with the top-8 candidates of each state. Top-1 is the share of cases in which a masked neighbor’s most likely token under the approximate beliefs is its exact post-placement one. Corr. and R2R^{2} compare the approximate with the exact foresight Φ(v)\Phi(v) , centered within each state, by Pearson correlation and by the share of variance explained without refitting. Argmax is the share of states in which the approximation ranks the exact best candidate first. Top-1 token known is a reference given each neighbor’s exact post-placement top-1 token. Bold marks the best approximation in each column.
Context of jjAt jjBelief about j+1j{+}1Belief about j+2j{+}2
…have received investment from [M]Before placingwide 0.27, with 0.27of 0.50, range 0.30
 Place individuals (0.59)and 0.43, with 0.43small 0.96, institutions 0.02
 Place a (0.36)diverse 0.79, range 0.12of 0.53, range 0.47
…typically made in private [M]Before placingbefore 0.42, that 0.22have 0.23, they 0.21
 Place companies (0.79)that 0.73, before 0.24have 0.61, they 0.32
 Place equity (0.20)funds 0.90, or 0.09, 0.85, venture 0.11
Appendix
Table 9: Real decision states of LLaDA-8B-Instruct in its low-confidence order, on prompts of the training pool. Each state gives the context of the committed position jj and the top-2 beliefs about the masked positions j+1j{+}1 and j+2j{+}2 , before placement and after placing each of the two most likely candidates, whose probabilities at jj are in parentheses.
Thresholdδ\deltaOursDLM-KGWDifference
TPR@1% (%)
Key-pooled265.252.5++ 12.7 [2.9, 20.9]
 389.985.4++ 4.5 [1.3, 7.9]
Own-key259.549.5++ 9.9 [ −- 1.1, 20.7]
 388.583.4++ 5.1 [0.9, 9.3]
[email protected]% (%)
Appendix
Table 10: TPR@1%, [email protected]% and log-PPL averaged over five generation keys, on 300 of the WaterBench-600 prompts with LLaDA-8B-Instruct in its low-confidence order. Key-pooled thresholds are the calibrated thresholds of the other tables, and own-key thresholds are calibrated on the unwatermarked responses re-detected with each key alone. The difference is ours minus DLM-KGW, with a 95% CI from a bootstrap over prompts (paired) and keys, and bold marks the differences whose CI excludes zero.
  DLM-KGWUnkeyed learned listLearned bands
  (previous-token hash)(our ablation)(ours)
TextnnGreen (%)FPR (%)Green (%)FPR (%)Green (%)FPR (%)
Human-written text
ELI553224.90.631.030.1 †25.30.9
FiQA20025.11.028.615.5 †25.11.0
C4 news28425.20.428.43.5 †25.11.8
Appendix
Table 11: Green rate and false-positive rate (FPR) of three kinds of green lists on human-written text and on unwatermarked LLaDA-8B-Instruct responses to WaterBench-600, with one key and γ=25%\gamma=25\% . The green rate is the share of scored units that are green, and the FPR is that of the exact test at a nominal 1% level (Proposition 2 for learned bands). Texts are scored on their first 256 tokens, and nn counts those with at least 50 scored units. The unkeyed learned list is a network that maps the context to a green list without a key, trained to keep the generator’s tokens green at rate γ\gamma . A dagger marks an FPR significantly above 1% (exact Clopper–Pearson 95% CI).
  TPR (%) ↑\uparrowlog-PPL ↓\downarrowJudge
  NominalCalibrated   
Methodδ\delta@1%@0.1%@1%@0.1%MeanMedian↑\uparrow
No watermark–0.20.0––1.2971.2739.12
dgMARK, greedy–90.883.392.784.21.5501.5319.07
dgMARK, top-3–93.083.892.384.31.5571.5479.12
DLM-KGW245.820.551.324.81.3161.2979.13
Appendix
Table 12: Full results on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence order, with nominal and calibrated TPRs (§ 4 ) and the mean and median log-PPL. In the No watermark row, the nominal columns give the false-positive rate. Bold marks the better of DLM-KGW and ours at the same δ\delta without a significance test, and Table 13 gives the paired differences.
  Same δ\deltaEqual log-PPL
  Δ\Delta TPR (points)  Δ\Delta TPR (points)
Orderδ\delta@1%@0.1%Δ\Delta log-PPLΔ\Delta Judge@1%@0.1%
Low-confidence2++ 18.2++ 19.2++ 0.010++ 0.16++ 13.6++ 13.1
  [13.2, 23.2][14.2, 24.3][ −- 0.014, 0.033][0.01, 0.31][2.3, 19.6][ −- 1.8, 20.4]
 3++ 3.7++ 9.3++ 0.011++ 0.33++ 2.7++ 7.4
  [0.5, 6.8][5.2, 13.8][ −- 0.015, 0.038][0.18, 0.49][ −- 1.0, 11.2][1.3, 18.5]
Appendix
Table 13: Paired differences of ours minus DLM-KGW on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence and random orders, at the same δ\delta and at equal log-PPL (§ 4 ). Brackets give paired bootstrap 95% CIs, and bold marks the estimates whose CI excludes zero. A dash means that our mean log-PPL lies below the range of DLM-KGW (equal log-PPL) or that the judge was not run (random order).
 Rep.Δ\Delta Judge vs. No watermarkΔ\Delta Judge vs. DLM-KGWΔ\Delta log-PPL vs. DLM-KGW
δ\deltaDLM-KGWOursAllNo loopAllNo loopAllNo loop
219.318.2++ 0.17++ 0.01++ 0.16−- 0.06++ 0.010−- 0.008
   [0.04, 0.31][ −- 0.08, 0.11][0.01, 0.31][ −- 0.14, 0.02][ −- 0.014, 0.033][ −- 0.035, 0.019]
323.314.0++ 0.18++ 0.03++ 0.33++ 0.03++ 0.011−- 0.007
   [0.05, 0.32][ −- 0.06, 0.12][0.18, 0.49][ −- 0.06, 0.13][ −- 0.015, 0.038][ −- 0.039, 0.024]
426.314.3++ 0.210.00++ 0.70++ 0.08−- 0.037−- 0.097
Appendix
Table 14: Repetition loops and paired quality differences on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence order. Without a watermark, Rep. is 19.3%. Each Δ\Delta is ours minus the compared method, over all 600 prompts (All) or over the prompts on which neither compared response loops (No loop, 385–446 prompts). Brackets give paired bootstrap 95% CIs, and bold marks the estimates whose CI excludes zero.
  Quality ↑\uparrowSimilarity ↑\uparrow
Methodδ\deltaGemmaQwenGemmaQwen
No watermark–9.128.55––
dgMARK, greedy–9.078.496.407.00
dgMARK, top-3–9.128.476.346.95
DLM-KGW29.138.536.637.23
Ours29.298.656.577.24
Appendix
Table 15: Quality and similarity of the responses of Table 1 (WaterBench-600, LLaDA-8B-Instruct, low-confidence order) under two judges, Gemma-4-12B-it and Qwen3-32B (FP8 weights), both greedy. Quality: mean of style and consistency (1–10) with the rubric of Gloaguen et al. (2026) and the same instruction text for every method. Similarity: shared meaning with the unwatermarked response to the same prompt (0–10). Unwatermarked responses of another sampler reach 6.71 and 6.77 (Gemma) and 7.33 and 7.32 (Qwen).
  ELI5FiQAAlpacaFarm
  TPR TPR TPR 
Methodδ\delta@1%Len.@1%Len.@1%Len.
No watermark––232–219–214
dgMARK, top-3–99.521995.520482.0209
DLM-KGW259.022948.522746.5217
Ours277.523077.022454.0214
Appendix
Table 16: Results per task on WaterBench-600 (200 prompts each) with LLaDA-8B-Instruct in its low-confidence order. TPR@1% uses the calibrated thresholds of Table 1 , and Len. is the mean response length in tokens. On AlpacaFarm, the share of responses shorter than 20 tokens is 4.5% without a watermark, 0.5–2.0% for DLM-KGW, 2.0–4.0% for ours and 6.5% for dgMARK, and no ELI5 or FiQA response is that short. Bold marks the better of DLM-KGW and ours at the same δ\delta .
   zˉ\bar{z}TPR (%) ↑\uparrowlog-PPLJudgeRep.
δ\deltaPartitionForesight↑\uparrow@1%@0.1%↓\downarrow↑\uparrow↓\downarrow
2Keyed hashCurrent beliefs2.3549.024.51.3379.1818.2
  Predictor2.6159.531.71.3519.2917.2
 Learned bandsNone ( λ=0\lambda=0 )2.0639.315.31.3179.2216.3
  Current beliefs2.7763.740.01.3089.2419.2
  Predictor2.9569.544.01.3269.2918.2
Appendix
Table 17: All metrics of the crossed ablation of Table 2 . TPR@1% and [email protected]% use calibrated thresholds. Bold marks the best of the four crossed cells at each δ\delta , and the shaded rows are ours.
    Δ\Delta TPR (points)  
ContrastHeld fixedδ\deltaΔzˉ\Delta\bar{z}@1%@0.1%Δ\Delta log-PPLΔ\Delta Judge
Partition
Learned bands vs. keyed hashCurrent beliefs2++ 0.41++ 14.7++ 15.5−- 0.028++ 0.06
   [0.29, 0.54][9.5, 19.8][10.5, 20.5][ −- 0.055, −- 0.002][ −- 0.08, 0.20]
  3++ 0.47++ 4.2++ 11.0−- 0.006−- 0.02
   [0.33, 0.61][0.8, 7.5][6.7, 15.5][ −- 0.033, 0.020][ −- 0.15, 0.10]
Appendix
Table 18: Paired differences behind § 5.2 and Table 19 , on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence order. Each row gives the first configuration minus the second, with the settings under Held fixed shared by both. Brackets give paired bootstrap 95% CIs, and bold marks the estimates whose CI excludes zero. A dash marks a difference that was not computed.
  δ=3\delta=3δ=4\delta=4
  zˉ\bar{z}TPR (%) ↑\uparrowlog-PPLJudgeRep.zˉ\bar{z}TPR (%) ↑\uparrowlog-PPLJudgeRep.
ScoreOrder↑\uparrow@1%@0.1%↓\downarrow↑\uparrow↓\downarrow↑\uparrow@1%@0.1%↓\downarrow↑\uparrow↓\downarrow
Unit-awareConsistent4.3589.379.31.3989.3014.05.9796.292.71.4699.3214.3
PlainConsistent4.3290.278.01.3658.9621.05.8296.091.51.4378.8820.8
PlainCurrent-tilt4.4992.280.31.4089.1218.75.8696.092.01.4928.9818.8
Appendix
Table 19: Decoding choices of our watermark with learned bands and the predictor, on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence order. The plain score omits the unit-aware correction (§ 3.1 ). The consistent order is that of § 3.4 , and the current-tilt order chooses the position with the current-belief tilt and applies the predicted tilt only afterwards (Appendix C.2 ). Columns are as in Table 2 , with [email protected]% and Rep. added, and the shaded row is ours.
Figure 5: The two learned components on the detection–quality trade-off, each against the cell with neither (keyed hash, current beliefs), on WaterBench-600 with LLaDA-8B-Instruct in its low-confidence order (unit-aware score and consistent order in every cell). (a) Gain in the mean zz -score at equal KL divergence from the model’s distribution. (b) KL saved at equal mean zz -score, with the saving as a share of the reference cell’s KL above each bar. (c) Reduction of the mean log-perplexity (Qwen3-8B) at equal TPR@1%. The reference cell is interpolated linearly between its strengths δ=2\delta=2 , 3 and 4, and error bars are paired bootstrap 95% CIs.
  δ=2\delta=2δ=3\delta=3δ=4\delta=4
PartitionForesightGQGQGQ
Keyed hashCurrent beliefs9.188.589.358.699.408.67
 Predictor9.298.679.318.649.398.63
Learned bandsCurrent beliefs9.248.609.338.699.248.59
 Predictor9.298.649.318.679.328.63
Learned bands −- keyed hashcurrent beliefs++ 0.06++ 0.01−- 0.020.00−- 0.15−- 0.08
Appendix
Table 20: Judge scores of the crossed ablation of Table 2 (WaterBench-600, LLaDA-8B-Instruct, low-confidence order), re-rated in one run per judge with the same instruction text for every cell: Gemma-4-12B-it (G) and Qwen3-32B with FP8 weights (Q), both greedy, mean of style and consistency (1–10). The bottom rows give paired differences, with the setting after the label held fixed, and bold marks those whose paired bootstrap 95% CI excludes zero. On these 7,200 responses, the two judges correlate at 0.78. Gemma scores can differ by 0.01 from Table 2 through rounding and, for some cells, another run.
   TPR (%)
Foresightδ\deltazˉ\bar{z}@1%@0.1%
Predictor22.9569.544.0
Exact23.1073.247.7
Predictor34.3589.379.3
Exact34.6693.383.8
Predictor45.9796.292.7
Appendix
Table 21: Predicted against exact foresight (learned partition, WaterBench-600, low-confidence order). TPR@1% and [email protected]% use calibrated thresholds.
PartitionForesightzˉ\bar{z}TPR@1% (%)log-PPL   
Keyed hashCurrent beliefs3.8384.41.387   
Keyed hashPredictor3.9886.91.389   
Learned bandsCurrent beliefs4.1688.21.399   
Learned bandsPredictor4.3389.21.399   
  Δzˉ\Delta\bar{z} per keyMean over keys
ContrastKey 1Key 2Key 3Key 4Δzˉ\Delta\bar{z}Δ\Delta log-PPL
Appendix
Table 22: The crossed ablation of Table 2 under four further generation keys (keys 1, 2, 3 and 4) at δ=3\delta=3 , on the same 300 of the WaterBench-600 prompts for every key, with LLaDA-8B-Instruct in its low-confidence order. The top rows average each cell over the keys, and their TPRs are nominal. The bottom rows give paired differences in zˉ\bar{z} per key and, averaged over the keys, in zˉ\bar{z} and log-PPL with paired bootstrap 95% CIs. Indented rows give the level of the other component. Both −- neither compares learned bands with the predictor against the keyed hash with current beliefs, and the interaction is the predictor’s gain with learned bands minus its gain with the keyed hash. Bold marks a difference whose 95% CI excludes zero, for one key or over the keys.
   TPR@1% (%)
   No attackDeletionInsertionSubstitution
hhzˉ\bar{z}log-PPL 10%20%10%20%10%20%
13.401.51877.365.353.364.056.756.747.3
23.781.49481.364.744.766.751.364.031.3
33.521.58874.750.723.356.030.745.319.3
43.661.60184.046.012.050.028.744.012.0
Appendix
Table 23: Context width hh of learned bands at δ=4\delta=4 , on the 150 development prompts (Table 5 ) with LLaDA-8B-Instruct in its low-confidence order. All rows use the plain score and no foresight ( λ=0\lambda=0 ). TPR@1% is nominal, without an attack and after deleting, inserting or substituting 10 or 20% of the tokens at random. The shaded row is the width we use ( h=2h=2 ), and bold marks the best value in each column.
 Per-token zz at e4e^{4}KL at e4e^{4}At the KL of B=4B=4
BBLearnedHash(nats)Per-token zzβ\beta
20.4080.3770.3580.4484.66
30.4810.4530.4310.4884.07
40.5150.4800.4440.5154.00
60.5310.4930.4180.5484.12
80.5270.4870.3810.5734.30
Appendix
Table 24: Offline comparison of the number of bands BB ( γ=1/B\gamma=1/B ) on the 10,277 held-out commit records from unwatermarked decoding of LLaDA-8B-Instruct in random order (Appendix C.1 ). The per-token zz is (g−γ)/γ(1−γ)(g-\gamma)/\sqrt{\gamma(1-\gamma)} , where gg is the expected probability, over a uniformly random key, that the committed token is green after a tilt of odds eβe^{\beta} toward the green band. Learned bands are optimized at β=4\beta=4 , the Hash column uses a keyed hash, and KL is the tilt’s KL divergence per token. The last two columns use, for each BB , the β\beta at which learned bands have the KL of B=4B=4 . The shaded row is the BB we use.
  zˉ\bar{z}TPR (%) ↑\uparrowKLlog-PPL
λ\lambdaForesight↑\uparrow@1%@0.1%↓\downarrow↓\downarrow
14\frac{1}{4}Current beliefs3.7583.360.728.91.365
 Predictor3.8088.765.328.91.368
12\frac{1}{2}Current beliefs4.1689.376.034.01.399
 Predictor4.4290.082.034.91.363
 gate 04.3592.784.034.71.381
Appendix
Table 25: Foresight weight λ\lambda and source of foresight at δ=3\delta=3 , on 150 of the WaterBench-600 prompts (learned bands, one run with the same seeds). TPRs use calibrated thresholds, and KL is the tilt’s KL divergence summed over a response’s commits. The predictor is used where the second most likely tilted candidate has probability at least 0.02, or at every position tilt in the rows marked gate 0. The shaded row is ours.
 HumanEvalMBPPGPQA-DiamondMMLU-Pro
MethodScoreTPR@1% (%)ScoreTPR@1% (%)ScoreTPR@1% (%)ScoreTPR@1% (%)
No watermark35.4–37.0–20.7–40.0–
DLM-KGW34.817.732.515.026.872.235.060.0
dgMARK, top-335.46.133.53.519.236.442.127.1
Ours39.612.838.025.023.769.232.162.9
Appendix
Table 26: Code and question answering per task with LLaDA-8B-Instruct in its low-confidence order at δ=4\delta=4 , with our components learned on WaterBench-style prompts, without code or QA training prompts. Score is pass@1 for code and accuracy for question answering, both in %. TPR@1% uses thresholds calibrated on the unwatermarked responses to the same prompts. Bold marks the best watermark in each column without a significance test.
   TPR (%)  
Methodδ\deltaValid (%)@1%@0.1%zˉ\bar{z}log-PPL
No watermark–62.80.20.0–2.188
DLM-KGW353.842.028.5–2.505
Ours, LLaDA partition378.257.339.72.752.290
Ours, Dream partition379.355.538.22.682.283
Ours, Dream partition + predictor381.360.043.82.892.278
Appendix
Table 27: Dream-v0-Instruct-7B on WaterBench-600 with its official decoding (random order, 256 steps), where ours uses the plain score. The No watermark row comes from Dream’s official code. The LLaDA partition is transferred through identical tokens, the Dream partition is learned on Dream’s decodings, and foresight uses the current beliefs except in the + predictor rows, which use the Dream predictor. Valid is the share of responses that pass the validity rule of DLM-KGW (at least 192 characters, at most half of the bigrams repeated). TPRs are nominal over all 600 responses, zˉ\bar{z} uses our detector, and log-PPL is over the responses that pass the rule. Bold marks the best value in each column at the same δ\delta .
  TPR@1% (%)[email protected]%  
Methodδ\deltaC4DollyWPAllAll (%)log-PPLRep.
No watermark–0.30.71.00.70.01.52311.7
dgMARK, greedy–63.087.373.374.663.72.18710.9
dgMARK, top-3–63.787.774.775.363.72.26512.8
DLM-KGW249.760.064.057.931.41.49813.9
Ours256.764.770.363.942.41.48811.7
Appendix
Table 28: Results on 900 out-of-distribution prompts from other writing tasks with LLaDA-8B-Instruct in its low-confidence order, with our components learned on WaterBench-style prompts and not retrained. The prompts are 300 C4 RealNewsLike news continuations, 300 Dolly creative-writing instructions and 300 WritingPrompts (WP). Thresholds are calibrated on the official unwatermarked responses to the same prompts, and for dgMARK on its own unwatermarked responses. Bold marks the better of DLM-KGW and ours at the same δ\delta .
 No attackDeletionInsertionSubstitutionParaphrase
MethodTPRAUCTPRAUCTPRAUCTPRAUCTPRAUC
DLM-KGW, random98.199.891.599.291.199.585.999.28.574.9
DLM-KGW, low-confidence96.399.886.799.584.898.976.798.18.571.2
dgMARK, global91.196.75.951.13.353.137.466.42.252.4
dgMARK, window51.592.711.174.013.778.527.086.23.357.8
Ours98.599.884.498.485.298.570.096.24.167.3
Appendix
Table 29: Robustness on 90 of the WaterBench-600 prompts with 3 seeds each, giving 270 watermarked texts of LLaDA-8B-Instruct per method, with δ=4\delta=4 for ours and DLM-KGW. Token-level attacks delete, insert or substitute 20% of the tokens at random, and paraphrasing uses Qwen2.5-32B-Instruct with the dgMARK prompt at temperature 0.2. TPR (%) is the TPR@1% with thresholds calibrated on 810 unwatermarked texts that receive the same attack, and AUC (%) is the area under the ROC curve between these unwatermarked texts and the 270 watermarked ones. Ours and dgMARK (greedy decoding) use the low-confidence order, and DLM-KGW uses both orders. The two dgMARK rows use its match-ratio statistic (global) and its sliding-window detector (window). Bold marks the best value in each column.
ArtifactLicense or terms
LLaDA-8B-InstructMIT
Dream-v0-Instruct-7BApache-2.0
Qwen3-8B, Qwen3-32B, Qwen2.5-32B-InstructApache-2.0
Gemma-4-12B-itApache-2.0
WaterBenchMIT
ELI5 (via KILT)MIT (KILT), no license stated for the Reddit text
Appendix
Table 30: Licenses or terms of the artifacts we use.
More in this topic

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 110 papers

Explore similar work

CardsList
Sep 29, 2025

Watermarking Diffusion Language Models

We introduce the first watermark tailored for diffusion language models (DLMs), an emergent LLM paradigm able to generate tokens in arbitrary order, in contrast to standard autoregressive language models (ARLMs) which generate tokens sequentially. While there has been much work in ARLM watermarking, a key challenge when attempting to apply these schemes directly to the DLM setting is that they rely on previously generated tokens, which are not always available with DLM generation. In this work we address this challenge by: (i) applying the watermark in expectation over the context even when some context tokens are yet to be determined, and (ii) promoting tokens which increase the watermark strength when used as context for other tokens. This is accomplished while keeping the watermark detector unchanged. Our experimental evaluation demonstrates that the DLM watermark leads to a >99% true positive rate with minimal quality impact and achieves similar robustness to existing ARLM watermarks, enabling for the first time reliable DLM watermarking.

Thibaud Gloaguen, Robin Staab, Nikola Jovanović +1

ETH Zurich

Diffusion Model WatermarkingLLM WatermarkingRobust WatermarkingDiffusion Language Models
AskPDF
Sep 28, 2026

TANGO: Watermarking Masked Diffusion Language Models in Token Pairs

Masked-diffusion language models fill in masked positions in parallel and in no fixed order. Most practical text watermarks assume left-to-right generation. They key each token to the tokens before it, and in a diffusion model those tokens may still be masked. A fixed green list needs no such context, but it favors the same tokens at every position, so these tokens appear more often in watermarked text. An attacker who compares token frequencies in watermarked and unwatermarked text can recover the list and forge text that the provider's own detector accepts. We present TANGO, a watermark for masked-diffusion language models that keys each new token to a nearby token that is already unmasked. A secret key splits the vocabulary into color classes, and TANGO biases the new token toward a color determined by the key and the nearby token's color. The watermark is therefore embedded in pairs of tokens. Because the favored color changes from position to position, token frequencies stay much closer to those of unwatermarked text than under a fixed green list. Detection needs only the text and the key, and it does not assume any unmasking order. On two masked-diffusion models, TANGO detects nearly all unedited watermarked texts and most edited ones, and frequency attacks that forge the fixed green list fail against it.

Kasra Arabi, Nir Weinberger, Micah Goldblum +1

Diffusion Model WatermarkingMasked Diffusion ModelsLLM WatermarkingRobustness of Machine-Generated Text Detection
AskPDF
May 6, 2026

Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks

Statistical watermarking is a common approach for verifying whether text was written by a language model. Most existing schemes assume autoregressive generation, where tokens are produced left to right and contextual hashing is well defined. Diffusion language models generate text by denoising tokens in arbitrary order, so these schemes cannot be applied directly. A recent watermark by Gloaguen et al. addresses this gap for LLaDA 8B Instruct and reports true positive detection above 99%. This paper studies what happens when watermarked text is rewritten not once but several times. Using the same watermark configuration, 1,605 watermarked completions of about 300 tokens each are produced across five WaterBench domains. Each completion is rewritten by four open weight language models, from 1.5B to 8B parameters, none of which know the watermark key. Five rewrite styles are tested: paraphrase, humanize, simplify, academic, and summarize expand. Each style is chained for up to five hops, producing 160,500 rewritten texts in total. The watermark is detected on 87.9% of the original outputs at the standard significance threshold. After a single rewrite, detection falls to between 14% and 41% depending on the rewriter and style. After five chained rewrites, detection falls to 4.86%, meaning 94.76% of the originally detected texts are no longer flagged. After three rewrites, the detector score has dropped 86% of the way from its watermarked baseline toward the null distribution. Repeated rewriting is therefore a much stronger attack than a single rewrite, and the result holds across all four rewriters tested.

Mohd Ruhul Ameen, Akif Islam, Nadim Mahmud +1

College of Engineering and Computer Science, Marshall University, Huntington, WV, USA · Department of Computer Science and Engineering, University of Rajshahi, Rajshahi, Bangladesh · Miami University, Oxford, OH 45056, USA

Diffusion Model WatermarkingWatermark RemovalLLM WatermarkingRobust WatermarkingDiffusion Language ModelsRobustness of Machine-Generated Text Detection+1
AskPDF