LLM Watermarking

LLM: Large Language Model

Large language model watermarking studies how to mark generated text, model behavior, or model parameters so that provenance, ownership, or use of protected data can later be checked. Common approaches add keyed statistical patterns to token sampling, encode messages with error-correcting codes, or place signals in semantic structure, model weights, activations, and agent actions. Researchers evaluate detection and message recovery alongside text quality, false-positive rates, and resistance to paraphrasing, translation, editing, fine-tuning, and other attacks. The central tension is making marks reliable and hard to forge or remove without harming usefulness, while ensuring detection remains trustworthy at real-world scale.

Latest papers

111 papers26 papers in the last four weeks, up 189% on the four weeks before. 0.2% of all new papers.

Watermark Basins: Black-Box Detection of Distilled LLMs
Oct 27, 2026Hongyan Chang, Hady Elsahar, Tom Sander +10LLM Watermarking Language Model Auditing
FAIR, Meta Superintelligence Labs
Watermarking Diffusion Language Models with Learned Foresight and Balanced Bands
Oct 23, 2026Hyojun Kim, Hyeseon An, Yo-Sub HanLLM Watermarking Diffusion Language Models
Yonsei University, Seoul, Republic of Korea
A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models
Oct 20, 2026Romina Omidi, Nima Naderloui, Yuan Hong +1LLM Watermarking Robustness of Machine-Generated Text Detection
Illinois Institute of Technology · University of Connecticut
ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models
Oct 19, 2026Yupeng Qiu, Han Fang, Ee-Chien ChangLLM Watermarking Robust Watermarking
School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui, China
Auditor-Assisted Summary-Channel Verification for Hosted LLM Identity Substitution
Oct 19, 2026Ziyi Zhang, Ziyao Wang, Guoheng Sun +2LLM Auditing LLM Watermarking
Stony Brook University · University of Maryland, College Park
Watermarkability: Measuring and Improving Language-Model Compatibility with Logit-Based Watermarks
Oct 16, 2026Zewei Deng, Mohamed Seif, Liyan XieLLM Watermarking
Department of Industrial and Systems Engineering, University of Minnesota · Department of Computer Science and Engineering, Oakland University · Princeton University
Pin It on Anyone: Certified Targeted Displacement of Multi-Bit LLM Watermarks Without the Key
Oct 13, 2026Paweł Batorski, Przemysław Spurek, Paul SwobodaLLM Watermarking Adversarial Text Attacks
Heinrich Heine University Düsseldorf · Jagiellonian University · IDEAS Research Institute
Perturbation, Not Provenance: Why Activation Steering Does Not Make a Robust Text Watermark
Oct 13, 2026Sergey PletenevLLM Watermarking Robust Watermarking
AIRI · Skoltech
textGrain watermarking is harder to detect: can sum-tests still do it optimally?
Oct 13, 2026Swapnaneel Bhattacharyya, Soham BonnerjeeWatermark Removal Detection LLM Watermarking
University of Pennsylvania
SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification
Oct 11, 2026Alan Tang, Lifeng Wang, Gang Wu +3Text Watermarking LLM Watermarking
Huawei Technologies Co., Ltd. · Harbin Institute of Technology, Shenzhen
Radioactive Feedback: Tracing Models Trained by Label-Only LLM Supervision
Oct 11, 2026Yuejia Li, JunHeng Li, Hao Wu +2LLM Watermarking Language Model Distillation
Wuhan University · Southeast University
ByteMark: A Unified Byte-Level Watermark for Detection Across Language Models
Oct 10, 2026Xiaopu Wang, Runze LiText Watermarking LLM Watermarking
Tokenization-Invariant Watermarking: A Byte-Local Method for LLM Text
Oct 9, 2026Tung-Ling LiLLM Watermarking Robust Watermarking
Independent Researcher
Could LLM Watermark Detection be Public?
Oct 8, 2026Georgios Milis, Tom Sander, Tomáš Souček +2LLM Watermarking Robust Watermarking
FAIR, Meta Superintelligence Labs · University of Maryland, College Park
Constitution-Guided Watermarking
Oct 7, 2026Toluwani Aremu, Samuele Poppi, Nils LukasLLM Watermarking Robust Watermarking
MBZUAI, Abu Dhabi, United Arab Emirates
Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents
Oct 6, 2026Suxin Ji, Hungtao Wan, Shaoxuan Chen +1LLM Watermarking Robust Watermarking
University of Pennsylvania · Independent Researcher · University of Massachusetts Amherst +1
SimpleMark: Fast Multi-Bit Text Watermarking under f -Divergence Constraints
Oct 5, 2026Benjamin D. Kim, Wanrong Zhang, Weitong Ruan +2Text Watermarking LLM Watermarking
Massachusetts Institute of Technology · Amazon · Stony Brook University +1
Grammar-Guided Code Watermarking with Green Temperature
Oct 4, 2026Hyundong Jin, Hyeseon An, Soohan Lim +1Text Watermarking LLM Watermarking
Department of Computer Science Yonsei University, Seoul, Republic of Korea
Invisible Ink, Visible Lies: How Production Watermarking Causes LLMs to Hallucinate
Oct 4, 2026Haocheng Ye, Aoting Hu, Xinwei Zhang +3Text Watermarking LLM Watermarking
Nanjing University of Science and Technology · Anhui University of Technology · The Hong Kong Polytechnic University +2
Language Model Fingerprinting Requires Rethinking Watermark Teachers
Oct 3, 2026Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1Language Model Fingerprinting Fingerprint Identification
Pohang University of Science and Technology · University of Washington
The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs
Oct 2, 2026Toluwani Aremu, Manit Baser, Mohan Gurusamy +2Adversarial Attacks on LLMs Open-Weight Language Models
MBZUAI, UAE · National University of Singapore · A*STAR Institute of Advanced Intelligence and Computing
RMCW: A Deletion-Robust Watermark Based on Reed--Muller Codes for Language Models
Oct 2, 2026Yi Wang, Baicheng Chen, Yu Wang +3LLM Watermarking Robust Watermarking
Institute for Interdisciplinary Information Sciences, Tsinghua University · University of Wisconsin–Madison · Shanghai Qi Zhi Institute, 3Xiongan AI Institute +2
Anchor-ECC: Local Integrity Checking for Watermarked LLM Outputs via Error-Correcting Codes
Sep 30, 2026Zewei Deng, Muhammad Siddeek, Liyan Xie +4Error-Correcting Codes Text Watermarking
University of Minnesota · Google · Oakland University +2
AutoMark: Enabling Autoresearch to Discover Better LLM Watermarks
Sep 29, 2026Thibaud Gloaguen, Robin Staab, Martin VechevText Watermarking LLM Watermarking
ETH Zurich
Beyond Semantic Narrowing: Robust and Efficient LLM Watermarking with Hamming Neighborhoods
Sep 29, 2026Zewen Sun, Tongyang Zhao, Liyao Xiang +3LLM Watermarking Robust Watermarking
Shanghai Jiao Tong University · Shanghai Innovation Institute · Northwest Polytechnical University, Xi’an
TTMark: Pairwise Distortion-Free Watermarking Beyond Single-Token Entropy
Sep 28, 2026Ruibo Chen, Zhengmian Hu, Donghang Lu +5Watermark Removal Detection Text Watermarking
University of Maryland, College Park · TikTok
TANGO: Watermarking Masked Diffusion Language Models in Token Pairs
Sep 28, 2026Kasra Arabi, Nir Weinberger, Micah Goldblum +1Diffusion Model Watermarking Masked Diffusion Models
CertMark: Distortion-Free Multi-Bit Watermarking with Certified Decoding
Sep 27, 2026Paweł Batorski, Przemysław Spurek, Paul SwobodaLLM Watermarking Robust Watermarking
Heinrich Heine University Düsseldorf · Jagiellonian University · IDEAS Research Institute
Agents Can Use Base Models to Evade AI Detection
Sep 25, 2026Bhuwan Dhingra, Danish PruthiAdversarial Text Attacks Robustness of Machine-Generated Text Detection
Duke University · Indian Institute of Science
Watermarkable Multi-Draft Speculative Sampling via Poisson Processes
Sep 18, 2026Yanxiao Liu, Sicheng Wan, Zhan Gao +1Speculative Decoding LLM Inference Acceleration
Imperial College London · University of Washington

Oct 27, 2026J/K move · Enter open · S save

Watermark Basins: Black-Box Detection of Distilled LLMs

Hongyan Chang, Hady Elsahar, Tom Sander, Pierre Fernandez+9

FAIR, Meta Superintelligence Labs

LLM Watermarking Language Model Auditing Language Model Distillation

Open paper AskPDF arXiv

Proprietary language models and their reasoning traces are vulnerable to API-based distillation, where an adversary trains a student model on the teacher model's outputs. To obtain evidence of distillation, model providers can watermark the teacher's outputs, aiming to leave a radioactive signal in the student's outputs. Existing black-box detectors search for such radioactivity using token-level statistics of the suspect model's outputs. However, token-level signals are not always detectable, for instance when the distillation traces are sampled at a low temperature. In this work, we discover the watermark basin, a persistent signal that enables more reliable watermark detection: during fine-tuning, watermarked teacher traces embed a distinct, key-specific geometric signal in parameter space that lies orthogonal to the ordinary task-specific fine-tuning subspace. Building on this, we introduce Watermark Basin Alignment (WM-Basin), a black-box watermark detector that queries the suspect model through its API, without access to its weights or logits. WM-Basin maps generated text to gradient representations using a fixed clean probe model, projects out the ordinary fine-tuning task directions, and tests whether the residual gradient aligns with the watermark basin induced by the watermark key. We evaluate WM-Basin extensively across diverse teacher models and student architectures (from 135M to 8.2B parameters) distilled on mathematical reasoning. At a strict 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, substantially improving over the state-of-the-art token-level baseline (29% and 1.3%, respectively). Because the watermark signal resides in a persistent basin, it survives post-distillation modifications including quantization, pruning, and reinforcement-learning post-training.