Research map / Large language models / Language, safety and interpretability

Learning to Watermark: A Selective Watermarking Framework for Large Language Models via Multi-Objective Optimization

NeurIPS 2025 · Large language models › Language, safety and interpretability · approach: Text watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Learning to Watermark (LTW), a selective LLM watermark where a lightweight MLP selector, trained with MGDA-based multi-objective loss, decides per token whether to apply KGW or Unigram watermarking, improving text quality while keeping detectability.

Problem

Watermarking LLM outputs trades off detectability against generated text quality; existing selective methods rely on hand-tuned entropy thresholds, and the watermark strength versus quality trade-off remains hard to balance.

Approach

A learned Selector Network (MLP) takes a SimCSE sentence embedding of recent tokens, current token entropy, and current watermark ratio to output a selection probability, thresholded by an adaptive ratio-dependent threshold; it is trained with two losses (quality and detectability) combined via MGDA to reach Pareto-optimal trade-offs.

Key results

• On OPT-6.7B under no attack, LTW-1 and LTW-0 reach AUROC 1.00000 and lower perplexity (13.62) than KGW (20.52) and SWEET (17.93).
• Under Dipper paraphrase attack on OPT-6.7B, LTW-0 achieves TPR@10 of 0.954 and AUROC 0.98326, versus 0.910 and 0.96987 for KGW.
• On GPT-J-6B, LTW-0 reduces perplexity to 9.56 compared with 16.55 for KGW, while LTW-1 gives the highest similarity (0.5286).

Measured effects reported in the paper

Surprising findings

• The fixed green-list variant (LTW-0, Unigram-based) is more robust to paraphrasing than the hash-based LTW-1 variant, attributed to avoiding green-list changes caused by rewritten previous tokens.
• The adaptive threshold ablation shows only small differences in z-score and perplexity, with a lower perplexity in only 4 of 6 strength settings.

Limitations

• Experiments use only small models (OPT-1.3B/6.7B, GPT-J-6B) and a single dataset (C4 RealNewsLike).
• The selector is trained only on continuation generations from OPT-1.3B, so transfer to other generation tasks is untested.
• No error bars or statistical significance reported; a fixed random key was used.

Experimental setup

Datasets: C4 RealNewsLike

Benchmarks: C4 RealNewsLike test set (500 samples)

Metrics: AUROC Best F1 TPR@FPR perplexity sentence embedding similarity

Baselines: KGW Unigram EXP-edit SWEET TS-watermark

Builds on: KGW watermark Unigram watermark SWEET MGDA SimCSE

Closest papers by meaning

• Token-Specific Watermarking with Enhanced Detectability and Semantic Coherence for Large Language Models (ICML 2024 · similarity 0.92)
• Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.92)
• PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.89)
• Adaptive Text Watermark for Large Language Models (ICML 2024 · similarity 0.89)
• On the Learnability of Watermarks for Language Models (ICLR 2024 · similarity 0.89)
• BiMark: Unbiased Multilayer Watermarking for Large Language Models (ICML 2025 · similarity 0.89)