Research map / Large language models / Language, safety and interpretability
Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a multi-bit text watermark that fine-tunes two TinyLlama-1.1B paraphrasers to behave differently, alternating them per sentence to encode bits, and decodes each bit with a trained LLM text classifier, co-trained via PPO.
Problem
Injecting a detectable, multi-bit watermark into text while preserving semantic fidelity and robustness to word substitution and sentence paraphrasing attacks; existing paraphrase-based and LLM-output watermarks achieve limited bit accuracy and detection AUC.
Approach
Use two LLM paraphrasers that are fine-tuned to paraphrase differently, switching between them at sentence boundaries to encode each bit, and co-train a classifier decoder with the encoders via PPO, using decoder correctness and similarity as rewards.
Key results
- Ours achieves 0.9563 bit accuracy with 5.57 bits and 0.9981 AUC, versus best baseline Waterfall (kappa=1) AUC 0.9392 and KTH zero-bit 0.8919.
- With five paraphrase repeats the method reaches over 0.99 bit accuracy and 0.9999 detection AUC.
- GPT in-context classification of watermark class achieves 57.0% accuracy, near the 50% random baseline.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the proposed paraphrasing watermark instead of existing watermark baselines | TinyLlama-1.1B watermarking · C4 RealNewsLike | AUC: 0.9392 -> 0.9981 | Helped |
| Use the proposed paraphrasing watermark instead of multi-bit baselines | TinyLlama-1.1B watermarking · C4 RealNewsLike | Bit Acc: 0.7663 -> 0.9563 | Helped |
| Add adversarial training using 10% word substitution (ablation) | Ours · Word substitution 20% | AUC: 0.9469 -> 0.9853 | Helped |
| Add adversarial training (ablation) | Ours · Sentence paraphrasing attacks | AUC: 0.9310 -> 0.9709; 0.8649 -> 0.9239; 0.8616 -> 0.9546 | Helped |
| Increase the similarity reward coefficient λs from 1.0 to 5.0 (ablation) | Ours · C4 RealNewsLike | Similarity: 0.8739 -> 0.9728 | Helped |
| Increase the similarity reward coefficient λs from 1.0 to 5.0 (ablation) | Ours · C4 RealNewsLike | AUC: 0.9981 -> 0.9028 | Hurt |
| Decrease the similarity reward coefficient λs from 1.0 to 0.2 (ablation) | Ours · C4 RealNewsLike | Bit Acc: 0.9563 -> 0.9722 | Helped |
| Decrease the similarity reward coefficient λs from 1.0 to 0.2 (ablation) | Ours · C4 RealNewsLike | Similarity: 0.8739 -> 0.8283 | Hurt |
| Decrease the KL coefficient λk from 0.02 to 0.005 (ablation) | Ours · C4 RealNewsLike | AUC: 0.9981 -> 0.9991 | Helped |
| Decrease the KL coefficient λk from 0.02 to 0.005 (ablation) | Ours · C4 RealNewsLike | Similarity: 0.8739 -> 0.8489 | Hurt |
| Use Llama-2-7B rather than TinyLlama-1.1B as paraphraser (ablation) | Ours · C4 RealNewsLike | AUC: 0.9981 -> 0.9973 | No clear effect |
Surprising findings
- Adding a similarity reward during PPO made the watermarked text more similar to the original than baselines (0.8739 vs. up to 0.8499).
- Under word substitution and paraphrasing attacks, all baselines degrade sharply; the Pegasus and Llama paraphrase attacks reduce the proposed method's TPR@1% in some settings relative to clean performance.
Limitations
- Robustness to sentence paraphrasing is weaker, e.g. bit accuracy 0.71-0.74 under LlamaPara and PegasusPara for the benign model.
- Weak performance on the Pile dataset due to structural text such as XML.
- Stealthiness evaluated only with GPT in-context classification, not human study.
Experimental setup
Datasets: C4 RealNewsLike Anthropic HH-RLHF PKU SafeRLHF UltraFeedback FineWeb Pile uncopyrighted synthetic-instruct-gptj-pairwise Reward datasets
Benchmarks: C4 RealNewsLike HH PKU Reward UltraFeedback FineWeb Pile
Metrics: bit accuracy bit num AUC TPR@FPR=1% TPR@FPR=0.01% similarity
Baselines: RemarkLLM KGW KTH Waterfall
Builds on: PPO GAE KGW KTH Waterfall
Closest papers by meaning
- ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transport (NeurIPS 2026 · similarity 0.91)
- PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.90)
- On the Reliability of Watermarks for Large Language Models (ICLR 2024 · similarity 0.89)
- MC$^2$Mark: Distortion-Free Multi-Bit Watermarking for Long Messages (NeurIPS 2026 · similarity 0.89)
- BiMark: Unbiased Multilayer Watermarking for Large Language Models (ICML 2025 · similarity 0.89)
- Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.