Research map / Large language models / Language, safety and interpretability
Watermarking Conditional Text Generation for AI Detection: Unveiling Challenges and a Semantic-Aware Watermark Remedy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that LM watermarks (Kirchenbauer-style hard/soft red lists) substantially degrade conditional text generation, and proposes a semantic-aware watermark that adds embedding-similar input-related tokens to the green list, improving ROUGE/BLEU while revealing a detection paradox (higher z-scores but lower AUC).
Problem
Watermarking language models for AI-text detection harms output quality when applied to conditional text generation (summarization, data-to-text), because random vocabulary partitions exclude source-relevant tokens that references require.
Approach
Use word-embedding similarity to the input context to place the top-k semantically related tokens for each input token into the green list before randomly partitioning the rest of the vocabulary, so that input-relevant content is not blocked by the watermark.
Key results
- On DART with BART-large, OW (hard) drops BLEU by 86.1% from 47.78 while SW (hard) drops only 14.1% to 41.04.
- On WebNLG with Flan-T5-base, OW (hard) drops BLEU by 97.0% from 59.77 to 1.80, while SW (soft) reaches 53.27 (10.9% drop).
- Human evaluation on 100 XSUM examples with BART-base: annotators preferred the semantic-aware watermark 55.33% vs 44.67% for the original (p=0.0358).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace the original hard watermark with the semantic-aware hard watermark | Conditional text generation models · CNN, XSUM, DART, and WebNLG | ROUGE-1 or BLEU: 33.38 -> 43.46; 24.47 -> 41.80; 29.60 -> 42.44; 22.98 -> 37.67; 6.65 -> 41.04; 5.35 -> 35.36; 9.25 -> 48.02; 1.80 -> 40. | Helped |
| Replace the original soft watermark with the semantic-aware soft watermark | Conditional text generation models · CNN, XSUM, DART, and WebNLG | ROUGE-1 or BLEU: 42.46 -> 43.50; 38.60 -> 41.90; 40.07 -> 43.83; 35.23 -> 38.79; 37.06 -> 44.04; 39.19 -> 44.18; 44.58 -> 52.50; 45.42 -> | Helped |
| Apply the original hard watermark rather than no watermark | BART-large and Flan-T5-base · CNN, XSUM, DART, and WebNLG | ROUGE-1 or BLEU: 43.80 -> 33.38; 41.78 -> 24.47; 45.25 -> 29.60; 39.51 -> 22.98; 47.78 -> 6.65; 49.55 -> 5.35; 57.18 -> 9.25; 59.77 -> 1. | Hurt |
| Use the semantic-aware watermark for BART-base instead of the original soft watermark | BART-base · XSUM human evaluation | human preference: 44.67% -> 55.33% | Helped |
| Use the semantic-aware watermark rather than the original watermark | Conditional text generation models · Conditional text generation detection | AUC: null | Hurt |
| Increase the number of semantically related tokens, from k=1 to k=10 (ablation) | BART-base with semantic-aware watermark, γ=0.25 · DART | BLEU: 37.23 -> 41.37 | Helped |
| Increase the number of semantically related tokens, from k=1 to k=10 (ablation) | BART-base with semantic-aware watermark, γ=0.5 · DART | BLEU: 38.46 -> 42.89 | Helped |
| Increase the number of semantically related tokens, from k=1 to k=10 (ablation) | BART-base with semantic-aware watermark, γ=0.75 · DART | BLEU: 41.36 -> 44.59 | Helped |
| Increase k in the semantic-aware watermark (ablation) | Watermarking across conditional generation tasks · Data-to-text generation versus summarization | generation score: null | Mixed |
| Set γ=0.05 with soft watermark strength δ≤4 (ablation) | Original soft watermark on BART-base · DART | performance trade-off: null | No clear effect |
Surprising findings
- Semantic-aware watermarks yield higher z-scores but lower AUC than the original watermark, a detection paradox caused by human use of input-similar tokens in CTG.
- On CNN/DailyMail, semantic-aware watermarking with Flan-T5-base slightly surpasses the no-watermark baseline in ROUGE.
Limitations
- Detection AUC decreases slightly relative to the original watermark (avg ~12.6% drop), a trade-off with quality.
- Human evaluation limited to 100 examples with BART-base on XSUM only.
- Evaluated only on small/base-scale encoder-decoder models (BART, Flan-T5).
Experimental setup
Datasets: CNN/DailyMail XSUM DART WebNLG
Benchmarks: CNN/DailyMail XSUM DART WebNLG
Metrics: ROUGE-1 ROUGE-2 ROUGE-L BLEU z-score AUC
Baselines: No watermark (NW) Original watermark (OW) hard Original watermark (OW) soft
Builds on: Kirchenbauer et al. soft/hard red list watermark
Closest papers by meaning
- Token-Specific Watermarking with Enhanced Detectability and Semantic Coherence for Large Language Models (ICML 2024 · similarity 0.89)
- Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · similarity 0.88)
- On the Learnability of Watermarks for Language Models (ICLR 2024 · similarity 0.88)
- Adaptive Text Watermark for Large Language Models (ICML 2024 · similarity 0.88)
- Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.88)
- GaussMark: A Practical Approach for Structural Watermarking of Language Models (ICML 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.