Homoglyph and invisible-character watermarks are edit-based watermarks. Instead of changing how a model generates text, they hide a signal in the text after it is written. They swap some characters for homoglyphs, which look the same, or very similar, but have different Unicode code points, or they insert characters that do not display, all without access to the model that wrote the text. Generation-time watermarks work less well for lower-resourced languages due to how tokenizers split their text. Because they work on individual characters, these watermarks never touch a tokenizer, so we ask whether they escape this gap. Across 40 language varieties in 24 scripts, we measure capacity (the hidden bits each character can carry), how much of it survives routine handling and targeted removal, and how much text a keyed detector needs. Capacity varies 3.3-fold and script accounts for 96% of that variation. Within Latin script, resource level makes no detectable difference (ρ=+0.095, p=0.78), but across scripts capacity rises with it (ρ=+0.54, 95% CI [+0.14,+0.83]), because lower-resourced languages tend to use scripts with few homoglyphs. Ordinary copy-paste, which strips invisible characters, widens the gap: a detector then needs about 2 code points of English or Persian but 93 of Lao. Removing the tokenizer does not remove the inequity, but instead only changes its source.
Figures & tables
Figure 1: Two strings that render alike but differ in code points; the highlighted edits are two Cyrillic homoglyphs and a zero-width space.
Transformation
Operation
Removes
Routine
identity
none
nothing
nfc
canonical composition
almost nothing
copy_paste
NFC, drop zero-width
insertion track
nfkc
compatibility composition
compat. variants
Deliberate (UTS #39)
Table 1: Transformation ladder ϕ . Routine transformations need no adversary; deliberate transformations use Unicode’s own defenses.
Figure 2: Untransformed capacity under πnone , in bits per character, by language (rows, grouped by script) and family (columns); the insertion column uses each language’s safe invisible characters. Family values are computed separately and do not add up to the total.
Figure 3: Untransformed capacity under πnone by script group, ordered by group median. Bars span the languages of the four scripts that have several; open markers are scripts with one language.
Figure 4: Untransformed capacity under πnone against the resource class of Joshi et al. (2020) . Horizontal offsets within a class only separate the points.
Quantity
Value
Evidence base
ICC, untransformed
0.963, p<10−4
24 scripts
ICC, per transformation
0.954–0.978
24 scripts
Mandarin, two orthographies
1.04× (copy-paste 1.24× )
1 contrast
Within Latin, ρ vs. class
+0.095 , p=0.78
11 languages
Script level, ρ vs. class
+0.544[+0.135,+0.826]
24 scripts
Language level, ρ vs. class
+0.487[+0.185,+0.740]
40 languages
Table 2: Fairness results. ρ is the rank correlation between capacity and resource class. Between-script rows count script groups as the evidence; intervals are 95% bootstraps that resample whole scripts, and the language-level row clusters its 40 languages by script.
Figure 5: Effective capacity under πnone , in bits per character with both tracks summed, for each language and transformation. The first column is the untransformed total of Table 4 ; the skeleton column keeps invisible characters (Table 1 ).
Figure 6: Detection AUC against span length for eight languages across the capacity range, under four attacks.
Figure 7: Measured nmin (TPR 95% at FPR 1%) against κeff at that length, one point per language. Lines are k/κeff with k fitted once per attack (policy πlang ).
Code
Language
Script
Class
eng_Latn
English
Latin
5
spa_Latn
Spanish (Lat. Am.)
Latin
5 †
fra_Latn
French
Latin
5
deu_Latn
German
Latin
5
por_Latn
Portuguese (Brazilian)
Latin
4 †
vie_Latn
Vietnamese
Latin
4
Table 3: The 40 language varieties. Class is the resource class of Joshi et al. (2020) , from 0 (least resourced) to 5 (most); † marks a class assigned by a judgement call rather than an exact name match.
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
κsub
Code
πintra
πlang
πnone
κins
κ
eng_Latn
4.50
4.50
4.78
2.30
7.09
spa_Latn
4.46
4.46
4.75
2.31
7.06
fra_Latn
4.38
4.38
4.64
2.31
6.95
deu_Latn
4.39
4.39
4.63
2.31
6.94
por_Latn
4.39
4.39
4.70
2.31
7.00
Appendix
Table 4: Undisturbed capacity in bits per character (real-text view, no attack). κ=κsub+κins at πnone , the identity column of Figure 5 .
Substitution track, ssub
Both tracks, stotal
Code
NFC
C-P
NFKC
MS-HR
MS-SS
Skel.
NFC
C-P
NFKC
MS-HR
MS-SS
Skel.
eng_Latn
1.00
1.00
0.59
0.94
0.94
0.47
1.00
0.67
0.72
0.96
0.96
0.64
spa_Latn
1.00
1.00
0.61
0.94
0.94
0.47
1.00
0.67
0.74
0.96
0.96
0.64
fra_Latn
1.00
1.00
0.60
0.95
0.95
0.47
1.00
0.66
0.73
0.96
0.96
0.65
deu_Latn
1.00
1.00
0.58
0.95
0.95
0.47
1.00
0.66
0.72
0.97
0.97
0.65
por_Latn
1.00
1.00
0.61
0.94
0.94
0.47
1.00
0.67
0.74
0.96
0.96
0.64
Appendix
Table 5: Survival s=κeff/κ by language and attack, policy πnone . C-P: copy-paste re-encoding; MS-HR and MS-SS: the mixed-script detector at the Highly Restrictive and Single Script levels; Skel.: skeleton mapping, which keeps invisible characters (Table 1 ). Insertion survival is not tabulated because it is constant: 1.00 for every language under every attack shown except copy-paste, where it is 0.00 for every language.
Figure 8: Perceptual safety is font-relative. A genuine cross-script letter twin is a pair with the same Unicode letter name and case in two of Latin, Cyrillic and Greek; there are 21, each counted in both directions (42 in all), and each row is a panel font that contains at least one. Left: mean normalized ink difference between the two glyphs of a twin, over all twins (bar) and by script pair (dots). Right: the fraction of the font’s renderable twins that render bit-identically. Glyphs are rendered in isolation, in the same font, at 48 pixels.
Detector: tokens flagged (%)
Identifier
Distance
Coverage
Eye-invisible share
Code
loud
quiet
loud, πintra
restricted
typical
nearest
rendered
≤0.02
identical
eng_Latn
94.7
0.5
2.2
0.70
0.62
0.14
0.75
0.16
0.15
spa_Latn
79.3
0.4
0.7
0.69
0.61
0.11
0.75
0.16
0.15
fra_Latn
81.4
0.4
6.0
0.71
0.61
0.13
0.75
0.15
0.14
deu_Latn
94.4
0.6
2.3
0.72
0.62
0.14
0.73
0.15
0.14
por_Latn
82.0
0.5
1.4
0.70
0.60
0.11
0.75
0.17
0.15
Appendix
Table 6: Stealth per language, πnone unless marked. Detector: % of tokens flagged at the Highly Restrictive level, substituting everywhere (loud) or skipping token-breaking substitutes (quiet). Identifier: share of substitution capacity in Restricted substitutes. On the typical-reader font stack: Distance, mean normalized ink difference to a typical and the nearest substitute (0 = identical); Coverage, share of substitution capacity whose substitutes render; Eye-invisible, share in substitutes within distance 0.02 of the original, and in bit-identical ones. Both eye-invisible shares come mostly from substitutes for the space character, and the check counts CARRIAGE RETURN, a line break in plain text, as identical to a space.
Code
Clean
Copy-paste
Mixed-script (HR)
NFKC
eng_Latn
1.95
[1.93, 1.96]
1.96
[1.94, 1.98]
1.95
[1.93, 1.96]
4.56
[3.94, 4.98]
spa_Latn
1.90
[1.87, 1.93]
2.05
[1.88, 2.93]
1.90
[1.87, 1.93]
3.97
[3.94, 4.47]
fra_Latn
1.93
[1.91, 1.94]
1.94
[1.92, 2.89]
1.93
[1.91, 1.94]
3.94
[2.94, 3.97]
deu_Latn
1.92
[1.91, 1.93]
1.93
[1.92, 1.97]
1.92
[1.91, 1.93]
2.96
[2.94, 3.48]
por_Latn
1.95
[1.88, 1.98]
1.96
[1.89, 2.00]
1.95
[1.88, 1.98]
3.95
[3.90, 3.97]
vie_Latn
1.96
[1.90, 2.76]
2.80
[1.98, 2.96]
1.96
[1.90, 2.76]
3.85
[2.95, 3.95]
Appendix
Table 7: Detection length nmin in code points, the shortest span that reaches a true-positive rate of 95% at a false-positive rate of 1%, with 95% bootstrap intervals. Policy πlang , canonical keying.
As watermarking of LLM-generated text enters deployment, users increasingly need to check text whose source is unknown. Existing detectors read the watermark through a specific tokenizer or embedding pipeline, and even if all providers adopted the same watermarking method, differences in these representations would leave their watermarks incompatible, and the text alone does not reveal which representation produced it. We propose ByteMark, a unified watermarking scheme that defines its signal on the UTF-8 bytes of published text. Models with different tokenizers embed this signal under one public specification and key, and a single detector verifies the text from the text and key alone. When the tokenizer or embedding model of a baseline detector is replaced, its detection degrades sharply, whereas ByteMark, which uses neither, retains its detection rate; ByteMark also remains detectable when participating models continue or rewrite the text.
We introduce Tokenization-Invariant Watermarking (TI-WM), a method that embeds a watermark during token generation but keys and scores it on canonicalized UTF-8 bytes. The detector does not invoke the tokenizer. Canonicalizer-preserving edits leave its score unchanged; other localized canonical-byte edits affect a bounded number of scoring windows. Across three fixed keys and 128 prompts per key and model, a deterministic white-box attack at a 5% word-edit budget leaves mean attacked-AUC 0.530 on Qwen3-8B and 0.664 on Gemma 4 E4B, compared with 0.410 and 0.489 for Unigram with detection-side deletion. These operating points are not jointly matched on quality and clean detectability. Bias sweeps show model-dependent distortion costs, and shared-rule controls support a locality interpretation without establishing a unique advantage of bytes. Visible insertion outside the canonicalizer's deletion set defeats the default design. Alphabetic filtering closes that channel but does not resolve source shift or calibrated detection power. TI-WM thus provides a concrete construction with local scoring guarantees and measured attack-ranking gains, not a general robustness or low-false-positive-rate deployment guarantee.
Watermarking should identify language-model output without degrading quality or limiting verification to the model provider. Multilingual deployment makes this harder because morphology, segmentation, and script change where watermark evidence can enter naturally. We introduce LUNA, a linguistically adaptive watermark that combines model-free detection with single-token non-distortion under the standard random-key model. LUNA estimates normalized next-tag entropy from part-of-speech contexts in an external corpus and uses it to set the depth of a non-distortionary binary tournament sampler; the detector reconstructs the same schedule from text, a tokenizer, a tagger, and a secret key. We evaluate six typologically diverse languages and two domains against eight primary baselines. LUNA attains an AUROC of 0.9959 and the lowest mean absolute median perplexity shift of 0.045 across the twelve settings; its 95% bootstrap interval [0.022, 0.073] lies below all baseline intervals. LUNA also records the lowest mean Self-BLEU, Distinct-1, surprisal, and entropy shifts. It is the only method that simultaneously achieves AUROC > 0.99 and an absolute median perplexity shift below 0.1 in a majority of settings, reaching this regime in 9 of the 12 settings while no baseline reaches it in more than 2. Our code is available at: https://github.com/Shinwoo-Park/luna_watermark
Shinwoo Park, Hyejin Park, Hyeseon An +1
Yonsei University, Seoul, Republic of Korea · Rensselaer Polytechnic Institute, Troy, NY, USA