Research map / Large language models / Language, safety and interpretability
Text watermarking
Embed detectable, robust watermarks into LLM output with provable guarantees.
80 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2022–2026) · an approach in Language, safety and interpretability, keyword cluster “watermarking · generated text · watermarks”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
22 papers in 2023–24 and 56 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic held steady, from 3.1% to 3.0%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2022 · Protecting Intellectual Property of Language Generation APIs with Lexical Watermark (AAAI 2022 · 54 citations)
- 2023 · A Watermark for Large Language Models (ICML 2023 · 112 citations)
- 2024 · Watermarking Conditional Text Generation for AI Detection: Unveiling Challenges and a Semantic-Aware Watermark Remedy (AAAI 2024 · 22 citations)
- 2025 · Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data? (AAAI 2025 · 3 citations)
- 2026 · Eguard: Defending LLM Embeddings Against Inversion Attacks via Text Mutual Information Optimization (AAAI 2026 · 2 citations)
Earliest papers here
- Protecting Intellectual Property of Language Generation APIs with Lexical Watermark (AAAI 2022 · 54 citations)
- Tracing Text Provenance via Context-Aware Lexical Substitution (AAAI 2022 · 51 citations)
- A Watermark for Large Language Models (ICML 2023 · 112 citations)
What has been tried
44 papers here report 447 measured changes (a component added, removed or swapped, compared with a baseline): helped 51%, no clear effect 13%, hurt 30%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Increase the number of semantically related tokens, from k=1 to k=10 | DART · BLEU | 37.23 -> 41.37 | Helped | Watermarking Conditional Text Generation for AI Detection: Unveiling Challenges and a Semantic-Aware Watermark Remedy (AAAI 2024 · 22 citations) |
| increase context width and use Skip or Min hashing rather than Additive hashing | GPT paraphrasing attack · ROC-AUC | Helped | On the Reliability of Watermarks for Large Language Models (ICLR 2024 · 22 citations) | |
| Increase watermark strength from δ=1.0 to δ=2.0 | OpenGen and LFQA, nucleus sampling, z = 6.0 · TPR | OpenGen: 0.576 -> 0.998; LFQA: 0.455 -> 1.000 | Helped | Provable Robust Watermarking for AI-Generated Text (ICLR 2024 · 15 citations) |
| Remove partial-context scores from the watermark-stealing attacker | Dolly CW, Llama2-7B owner, n=30,000 queries · FPR* @1e-6 | around 80% to below 50% | Hurt | Watermark Stealing in Large Language Models (ICML 2024 · 6 citations) |
| Add shared generator/detector embedding layers without fine-tuning | C4 and DBpedia Class, Top-K sampling; GPT-2, OPT 1.3B, and LLaMA 7B · F1 | GPT-2 C4: 0.5 -> 99.3; DBpedia: 47.5 -> 99.0. OPT 1.3B C4: 0.0 -> 97.5; DBpedia: 1.3 -> 98.0. LLaMA 7B C4: 31.4 -> 98.2; | Helped | An Unforgeable Publicly Verifiable Watermark for Large Language Models (ICLR 2024 · 5 citations) |
| Replace the adopted tanh(1000*x) watermark-logit scaling with another tested scaling | Text quality across watermark strengths · perplexity | No clear effect | A Semantic Invariant Robust Watermark for Large Language Models (ICLR 2024 · 4 citations) | |
| Increase soft-red-list δ from 0.0 to 1.0 | CNN-DM text summarization · ROUGE-1 | 38.56±0.09 -> 38.20±0.09 | Hurt | Unbiased Watermark for Large Language Models (ICLR 2024 · 4 citations) |
| Increase α from 0.45 to 0.5 | text generation, z=1.517/√n · TPR | 0.9794 -> 0.9827 | No clear effect | A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models (ICML 2024 · 4 citations) |
| remove de-duplication | Null hypothesis, open and closed model · average p-value | Open: 0.46±0.27 -> 0.053±0.12; Closed: 0.42±0.30 -> <10^{-30} | Hurt | Watermarking Makes Language Models Radioactive (NeurIPS 2024 · 4 citations) |
| Increase LLaMA-2 model size | BookTection · AUC | Helped | DE-COP: Detecting Copyrighted Content in Language Models Training Data (ICML 2024 · 3 citations) | |
| Increase beam-search tokens from b=0 to b=6 | Mark My Words benchmark, θ=1.0 · detectability | Helped | WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off (NeurIPS 2024 · 3 citations) | |
| Use lower-distortion watermark settings | C4 RealNewsLike · median detection p-value | 9e-18 -> 1e-01 | Hurt | On the Learnability of Watermarks for Language Models (ICLR 2024 · 2 citations) |
What reviewers will expect
Datasets and baselines named in the 30 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- C4 RealNewsLike · 8 of 30 papers
- C4 · 7 of 30 papers
- ELI5 · 4 of 30 papers
- MBPP · 4 of 30 papers
- HumanEval · 4 of 30 papers
- Wikipedia · 3 of 30 papers
- OpenWebText · 3 of 30 papers
- GSM8K · 3 of 30 papers
Baselines
- MPAC · 6 of 30 papers
- DiPmark · 5 of 30 papers
- KGW · 5 of 30 papers
- BiMark · 4 of 30 papers
- Unigram · 3 of 30 papers
- SWEET · 3 of 30 papers
- EXP-edit · 3 of 30 papers
- Unigram-Watermark · 2 of 30 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 78 papers; from OpenAlex and the papers' affiliations).
- University of Maryland, College Park · 8 papers
- Carnegie Mellon University · 5 papers
- UC Santa Barbara · 4 papers
- ETHZ - ETH Zurich · 3 papers
- Tsinghua University · 2 papers
- The Chinese University of Hong Kong · 2 papers
- Tencent · 2 papers
- Peking University · 2 papers
- University of California, Santa Barbara · 2 papers
- University of Waterloo · 2 papers
Use it
Download BibTeX of 24 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Zero-shot machine-text detection (82 papers)
- Data and hallucination detection (66 papers)
Elsewhere in the topic
- LLM unlearning and benchmarks (298 papers)
- LLM pruning and scaling data (285 papers)
- Controlled text generation (220 papers)
- Faithfulness of LLM explanations (169 papers)
- Data and evaluation methodology (136 papers)
- Uncertainty quantification for LLMs (136 papers)
- Pruning and circuits in LLMs (135 papers)
- Statistical frameworks for LLM evaluation (124 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).