Research map / Large language models / Language, safety and interpretability

Learning to Follow In-Context Watermark Instructions via Self-Distillation

NeurIPS 2026 · Large language models › Language, safety and interpretability · approach: In-context learning analysis · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces ICWBench for evaluating in-context watermark instruction following across 14 frontier LLMs, and a two-stage self-contained training method (self-distillation with logits perturbation, then GRPO with a statistical verifier reward) that raises Qwen3-14B and GPT-OSS-20B watermark detectability while keeping quality.

Problem

In-context watermarking relies on LLMs following an embedded instruction to produce statistically detectable signals without degrading answer quality, but current LLMs' ability to do this is unmeasured and weak models lack a cold start for RL.

Approach

Convert ICW instruction following into an instruction-equivalent decoding-time logit perturbation on the base model, use the perturbed base model as a teacher for self-distillation of a student that sees the instruction, then refine with GRPO using the statistical verifier as reward.

Key results

• Qwen3-14B average TPR@1%FPR rises from 0.100 to 0.974 after the two-stage method across TSP, WIP, SA.
• GPT-OSS-20B average TPR@1%FPR rises from 0.337 to 0.968.
• Gemini-3-pro reaches WIP AUC 1.000 but perplexity inflates to 67.61 versus about 4-7 for other models, showing over-following; no frontier model exceeds 0.66 AUC on TSP.

Surprising findings

• Gemini-3-pro achieves near-perfect WIP detection but at a large perplexity cost (67.61), an over-following failure.
• RL directly on the base model yields reward hacking on SA via formatting and word-splitting artifacts.

Limitations

• Robust watermark is theoretically impossible under unrestricted semantic edits; RLCracker reaches high evasion when coverage constraints are loose.
• Quality evaluated with gpt-4o-mini judge and perplexity under reference models, which are proxies.
• Only two open-weight backbones trained; benchmark uses 500 LFQA queries.

Experimental setup

Datasets: LFQA BioASQ FiQA

Benchmarks: ICWBench

Metrics: ROC-AUC TPR@1%FPR perplexity LLM-as-a-Judge score

Baselines: GPT-5.4 GPT-5.4-mini GPT-5.4-nano Gemini-3-pro Gemini-3-flash Claude-opus-4.5 Claude-sonnet-4.5 Claude-haiku-4.5 DeepSeek-v4-pro DeepSeek-v4-flash Qwen3-235B GPT-OSS-120B

Builds on: GRPO in-context watermarking unique-token watermark z-test

Closest papers by meaning

• PRO: Enabling Precise and Robust Text Watermark for Open-Source LLMs (NeurIPS 2026 · similarity 0.88)
• Learning to Watermark: A Selective Watermarking Framework for Large Language Models via Multi-Objective Optimization (NeurIPS 2025 · similarity 0.87)
• On the Learnability of Watermarks for Language Models (ICLR 2024 · similarity 0.87)
• An End-to-End Model for Logits-Based Large Language Models Watermarking (ICML 2025 · similarity 0.86)
• ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transport (NeurIPS 2026 · similarity 0.86)
• Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach (NeurIPS 2025 · similarity 0.86)