SAM ARK: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness Jiahao Huo†‡ , Wenjie Qu§ , Yibo Yan†∗ , Kening Zheng‡ , Jiaheng Zhang§ , Xuming Hu†∗ , Philip S. Yu‡ , Mingxun Zhou∗ B ∗ The Hong Kong University of Science and Technology † The Hong Kong University of Science and Technology (Guangzhou)
arXiv:2605.25796v1 [cs.CR] 25 May 2026
‡ University of Illinois Chicago § National University of Singapore
Emails: [email protected], [email protected] B Corresponding author. Abstract—Semantic-level watermarking (SWM) improves robustness against text modifications by treating sentences as the basic unit. However, robustness to paragraph-level paraphrasing remains difficult because such attacks globally disrupt watermark signals by changing sentence order. In this work, we propose SAM ARK, a self-anchored watermarking framework that removes the dependency on sentence order by establishing a step-independent green region in semantic space. To improve detectability, we introduce a multi-channel hyperbolic scoring mechanism that amplifies watermark signals while suppressing noise from weakly aligned candidates. We further propose a diversity-aware filtering strategy that combines hard filtering with soft regularization, extending beyond simple n-gram repetition filters to address semantic redundancy. Experimental results show that SAM ARK achieves up to 90.2% TP@FP1% under typical paragraph-level paraphrasing attacks, outperforming the strongest prior baseline by more than 30% on average, while maintaining generation quality competitive with unwatermarked text and breaking the robustness-quality tradeoff that limits prior methods.
1. Introduction The rapid advancement of generative AI (GenAI) has transformed content creation across many domains, from education to software development. Yet the growing ability of these models to produce realistic and persuasive content has also raised concerns about authenticity, attribution, and misuse. LLM watermarking, which embeds imperceptible yet algorithmically detectable signals into model outputs to identify AI-generated text, has emerged as a promising way to mitigate such risks. During generation, watermarking subtly modifies model outputs while preserving meaning and fluency, embedding a hidden, consistent signal that serves as a verifiable marker of GenAI origin. The watermark can later be detected from the generated output, enabling verification without relying on inherent statistical artifacts of the language model and offering a more resilient way to distinguish machine-
generated content from human-authored work. In practical use, AI-generated text is rarely kept unchanged. Users often edit, shorten, or paraphrase generated drafts to match a target style, format, or audience. A watermarking scheme for text traceability therefore needs to preserve its signal under these routine modifications. Currently, most existing watermark methods fall into two categories, namely tokenlevel watermarking and semantic-level watermarking. Token-level Watermarking. Token-level watermarking (TWM) schemes for LLMs have been widely studied. GreenRed schemes [1], [2] assign tokens to keyed green and red subsets and bias sampling toward green tokens; the detector then tests whether the generated text contains an unusually high fraction of green tokens. This mechanism provides a simple statistical signal, but it changes the original sampling distribution of the LLM and can degrade text quality [3]. Distortion-free methods, including Gumbel Watermarking [4] and PRC-based pseudorandom error-correcting schemes [5], reduce this distributional distortion and provide theoretical guarantees on text quality. However, their guarantees mainly address generation quality rather than edit robustness. Local modifications such as word deletion, substitution, and paraphrasing can still remove or dilute token-level evidence, which limits the reliability of TWM in adversarial or postedited settings [6]. Semantic-level Watermarking. To improve robustness to such attacks, semantic-level watermarking (SWM) approaches, such as SemStamp [6], [7], [8], treat a semantically complete sentence as the basic watermarking unit. These methods use rejection sampling to ensure that generated sentences fall within a valid semantic region of the embedding space, analogous to the green list in Green-Red watermarking. Recently, PMark [9] increased watermark density in SWM by applying multi-channel constraints during sampling, further improving robustness against sentencelevel paraphrasing attacks. Despite these efforts, current SWM methods still rely on context hashing or fixed private keys to partition green and red regions during sampling [6], [7], [9]. This reliance makes them vulnerable to paragraphlevel paraphrasing attacks (PPA), which can globally disrupt
Figure 1. Comparison between step-dependent watermarks and SAM ARK. TABLE 1. Q UALITATIVE COMPARISON OF REPRESENTATIVE WATERMARKING METHODS ACROSS THE THREE DESIRED PROPERTIES . Q UALITY – AVG R ANK ∆ VS . UNWATERMARKED : ★★★ (∆ ≤ −0.5), ★★ (|∆| ≤ 0.5), ★ (∆ > 0.5). ROBUSTNESS – TP@FP1% UNDER PPA: ★★★ (≥ 70%), ★★ (30−70%), ★ (< 30%). E FFICIENCY – SAMPLED TOKENS PER OUTPUT TOKEN RELATIVE TO KGW; LOWER IS BETTER . Method KGW [1] SynthID [10] SemStamp [6] PMark [9] SAM ARK (Ours)
Text Quality
Robustness
Token Cost
★ ★★★ ★★ ★★★ ★★★
★★ ★ ★★ ★★ ★★★
1x 1x 64x 100x 47x
watermark signals by changing sentence order. Achieving robustness to PPA has long been regarded as an intractable problem in the community [9]. The limitations of TWM and SWM discussed above reflect a broader set of practical requirements that the community has gradually converged on. Specifically, several desirable properties have emerged. First, the detector for a watermarking scheme should accurately distinguish LLMgenerated and human-written content, meaning that it should be unlikely to flag content produced independently of the watermarking keys as watermarked (usually measured by TP@FP1%). Second, the watermark should not degrade the model’s generation quality. In practice, the quality of watermarked text should remain competitive with that of unwatermarked content. Furthermore, watermark detectability should remain robust under adversarial attacks, so a high TP@FP1% is desirable even for modified or paraphrased outputs. Finally, the watermarking scheme should be efficient and incur minimal latency overhead, enabling practical deployment in LLM services. We summarize a qualitative comparison of representative watermarking methods across the three desired properties in Table 1. Is a PPA-robust SWM method possible? Given the status quo, we ask the following question: Can we develop a high-quality semantic-level watermarking scheme that is inherently robust to paragraph-level paraphrasing attacks? An affirmative answer would reshape the practical landscape of SWM. Specifically, our goal is to realize an SWM
Figure 2. Illustration of semantic-level watermark and unwatermarked semantic distribution.
method that is robust and quality-preserving, thereby enabling practical deployment in LLM services.
1.1. Our Contribution Our first insight is that the vulnerability to paragraphlevel paraphrasing attacks of most existing watermarking schemes and their variants [1], [6], [9], [10] stems from their reliance on step-dependent random seeds. We show that the intrinsic semantic content of each unit is the most reliable invariant under such attacks, motivating a shift away from step-dependent seed generation. Our second insight is based on the observation that concentrated watermark scores in semantic-level watermarking can degrade detectability under attacks, as shown in Figure 2. Such concentration increases the risk of sign flips under paraphrasing attacks, posing a direct threat to PPA robustness. We therefore argue that avoiding this concentration near the region boundary is essential for robustness. In practice, we incorporate a hyperbolic sampling strategy into our pipeline to achieve this goal (see Section 3.2). Self-anchored Paradigm. Building on these insights, our main technical contribution is SAM ARK, a novel selfanchored watermarking framework. The core of our method is to eliminate step dependence by establishing a stepindependent green region within semantic space. By making the random seed depend solely on the unit’s own semantics, we ensure that the watermark survives both text perturbation and sentence reordering. Multi-channel Hyperbolic Scoring and Quality Control. To realize this framework, we tackle two technical challenges: signal detectability and generation quality. For signal enhancement, we introduce a multi-channel hyperbolic scoring mechanism that amplifies robust watermark signals while suppressing noise from weakly aligned candidates. To maintain text quality, we propose a diversity-aware filtering strategy that combines n-gram and semantic hard filtering with soft regularization to prevent redundant generation and encourage lexical novelty.
Comprehensive Evaluation. Extensive empirical evaluations demonstrate that SAM ARK achieves strong robustness. Under extreme paragraph-level paraphrasing attacks where existing baselines largely fail, our method maintains high detectability. Furthermore, our results show that SAM ARK preserves generation quality competitive with that of unwatermarked text, effectively narrowing the traditional robustnessquality trade-off. Ablation studies further confirm the necessity of each component, showing that removing key modules can lead to a 20% drop in post-attack TP@FP1%. The remainder of this paper is organized as follows. Section 5 reviews related work on token-level and semanticlevel watermarking. Section 2 formalizes the problem and analyzes the limitations of current approaches. Section 3 details the proposed SAM ARK framework and its key components. Section 4 presents the experimental setup, main results, and comprehensive evaluations. Finally, Section 6 discusses possible limitations and future directions, while Section 7 concludes the paper.
2. Problem Definition and Preliminaries To motivate our approach, we first formalize the general framework of existing watermarking methods and then analyze why they fail under paragraph-level paraphrasing attacks (PPA). This analysis reveals that step-dependent random seeds are the root cause of vulnerability, guiding us toward a self-anchored solution.
Output Sampling (G). The seed rt defines a green region partition Gt = P(Ω; rt ), and the output ut is preferentially sampled from Gt via ut = G(π, u<t , Gt ) ∼ pw π (· | u<t ; k). • Detection (S). The detector quantifies the correlation between generated units and reconstructed seeds. The PT overall detection score is S(X) = t=1 S(ut , rt ). Robustness is typically pursued by maximizing S(X) during generation while maintaining text quality through a carefully designed sampling algorithm G. •
2.2. Brief Introduction to Existing Methods and Their Limitations Token- and Semantic-level Green-Red Paradigm. The Green-Red paradigm was initially introduced for tokenlevel watermarking [1]. At generation step t, a seed rt = R(ut−w , . . . , ut−1 ; k) is used to partition the vocabulary V into a green list Gt and a red list Rt = V \ Gt , with (t) |Gt | = γ|V|. Given the model logits ℓv for each token v ∈ V , TWM increases the probability of green tokens by adding a positive logit bias δ : (t) exp(ℓv + δ) , v ∈ Gt , Λ pw π (v | u<t ; k) = (t) exp(ℓ ) v , v ∈ Rt , Λ X X (t) (t) where Λ = exp(ℓv′ + δ) + exp(ℓv′ ). v ′ ∈Gt
2.1. Problem Setup and General Framework Problem Setup. Let V denote the vocabulary of an LLM π π . The text generation process is denoted by x − → y , where a response y is sampled from the model given an input prompt x. We define V ∗ as the set of all semantically complete sentences, including the null sentence of length zero. Let u ∈ Ω denote the basic unit of watermark generation, where Ω represents the set of all possible units, such as a token v ∈ V in a token-level watermarking (TWM) scheme or a sentence s ∈ V ∗ in a semantic-level watermarking (SWM) scheme. At each generation step t, the probability distribution of producing the next unit ut ∈ Ω given the preceding context u<t = (u1 , . . . , ut−1 ) is denoted by pπ (· | u<t ). General Framework. Existing generative watermarking schemes typically consist of three key components: a random seed generator R, a sampling algorithm G, and a scoring function S. We introduce a private key k drawn from a key space K. The watermarked output follows a modified conditional distribution pw π (ut | u<t ; k). The unified generation and detection process can be formalized as: • Fetching the Random Seed (R). At step t, a random seed rt is generated. For context-hashing-based watermarks, rt = R(ut−w , . . . , ut−1 ; k), where w denotes the context window size. For fixed-key watermarks, the seed is step-dependent but context-independent: rt = R(t; k).
v ′ ∈Rt
Semantic-level watermarking follows the same partitioning principle, but the partition is defined over the unit space Ω = V ∗ rather than the token vocabulary. Given a contextdependent seed rt = R(ut−w , . . . , ut−1 ; k), the semantic space is partitioned into Gt = P(Ω; rt ) and Rt = Ω \ Gt , often through locality-sensitive hashing over sentence embeddings. SWM then performs rejection sampling: a candidate sentence u is accepted only if u ∈ Gt . Equivalently, the watermarked distribution is the model distribution truncated to the green region: pπ (u | u<t ) , u ∈ Gt , pw Zt π (u | u<t ; k) = 0, u ∈ Rt , X ′ where Zt = pπ (u | u<t ). u′ ∈Gt
We identify two fundamental vulnerabilities in existing watermarking schemes that stem from their reliance on stepdependent random seeds. Context-Dependent Seeds are Fragile. Most existing TWMs [1], [10] and SWMs [6], [7] rely on context-hashing mechanisms, where the random seed depends strictly on the preceding context: rt = R(ut−h , . . . , ut−1 ; k). Paraphrasing attacks involving synonym substitutions and unit modifications perturb the context sequence, thereby altering the reconstructed seeds. The detection score changes to P ′ ′ ′ S(X ′ ) = S (u t , R(ut−h , . . . , ut−1 ; k)), shifting from t
the watermarked distribution Dw back toward the unwatermarked distribution Dn and causing detection failure. Step-Dependent Seeds Cannot Survive Reordering. Some watermarking schemes [9] use step-dependent fixed private keys rt = R(t; k) to avoid context dependency. However, they remain vulnerable to unit reordering. When paraphrasing attacks alter the sequence order, P the detection score becomes a mismatched sum S(X ′ ) = t S(u′t , rt ), leading to a drop of up to 40% in TP@FP1%. Semantics as the Only Invariant. From the above analysis, we conclude that the most reliable invariant property of watermarked text under PPA is the intrinsic semantic content of each unit, denoted by ϕ(ut ). This semantic representation is preserved even when the surface form or step position changes. This insight motivates our self-anchored paradigm: by making the random seed depend solely on the unit’s own semantics, i.e., rt = R(ϕ(ut ); k), we can achieve robustness against both perturbation and reordering.
2.3. The Robustness-Quality Trade-off Pursuing Robustness Degrades Quality. While existing methods strive to enhance robustness, they often introduce quality degradation [11]. Watermark generators tend to repeat previous n-grams and sentences because of the strong constraints imposed by limited green sets. Although ngram repetition filters [12] have been used to avoid looped generation, their effectiveness is limited when detecting semantic-level overlap. This trade-off constrains the practical potential of robust watermarking schemes. Smarter Filtering for Better Robustness-Quality Trade-off. We observe that simple surface-level filters fail to capture semantic redundancy. To address this, we propose a diversity-aware filtering mechanism that operates at both lexical and semantic levels, enabling the selection of candidates that are simultaneously high-scoring (robust) and diverse (high-quality). This pushes the frontier of the robustness-quality trade-off.
3.1. Rethinking Sampling Strategy with SelfAnchored Constraints In this section, we formulate the constraints for a selfanchored watermark by replacing the step-dependent components in the general framework with step-independent counterparts. We define the Self-Anchored Condition (SAC) as: rt = R(ut ; k) SAC: Gt = P(Ω; rt ) u = G(π, u , G ) ∼ pw (· | u , k) ∈ G t <t t <t t π (1) Theorem 1 (Step-independent Feasible Region). There exists a step-independent feasible region G ⊆ Ω such that any unit u ∈ G strictly satisfies Eq. 1 at any generation step t, while any v ∈ / G consistently violates it. Proof. By the definition of the Self-Anchored Condition in Eq. 1, the random seed rt = R(ut ; k) and the corresponding partition Gt = P(Ω; rt ) depend exclusively on the current unit ut and the fixed key k . They are strictly decoupled from the generation step t and the preceding context u<t . Therefore, we can explicitly construct the step-independent feasible region G as: G = {u ∈ Ω | u ∈ P(Ω; R(u; k))}.
For any unit u ∈ G , assigning ut = u at an arbitrary step t deterministically yields the seed rt = R(u; k) and the partition Gt = P(Ω; rt ). By the definition of the set G , it holds that ut ∈ Gt , which strictly satisfies the constraint in Eq. 1. Conversely, for any unit v ∈ / G , it inherently follows that v ∈ / P(Ω; R(v; k)). Consequently, assigning ut = v invariably results in ut ∈ / Gt , which consistently violates Eq. 1 regardless of the step t. This completes the proof. Theorem 1 demonstrates that the self-anchored conditions in Eq. 1 are mathematically equivalent to establishing a globally static green region within the entire space Ω per response.
3.2. SAM ARK Generator: Multi-channel Hyperbolic Sampling
3. SAMark: Self-anchored Watermark Building on the insights from Section 2, we propose SAM ARK, a self-anchored watermarking framework that achieves robustness against paragraph-level paraphrasing by making each sentence’s watermark signal depend solely on its own semantics. Our method combines three key components: (1) a theoretically grounded self-anchored constraint that establishes a step-independent green region, (2) a multi-channel hyperbolic scoring mechanism that amplifies watermark signals for improved detectability, and (3) a diversity-aware filtering strategy that maintains text quality without sacrificing robustness. Figure 3 illustrates the overall framework of our proposed method.
We adopt the multi-channel sampling paradigm from PMark [9] and introduce a hyperbolic-enhanced scoring mechanism for candidate sampling. Given c pivot vectors V = {v1 , . . . , vc } ∈ Rd living in the embedding space of text encoder E and a target flag pattern R = {r1 , . . . , rc } ∈ {−1, 1}c , the step-independent green region is defined as {u ∈ Ω | sgn(⟨E(u), vj ⟩) = rj , ∀j ∈ {1, . . . , c}}, with ⟨·, ·⟩ denoting the inner product and sgn(·) denoting the signum function. To add feasibility, the target flag pattern R is chosen uniformly at random for each query on the generation side and is not shared with the detection side, reducing storage overhead. The generation process proceeds as follows: • Candidate Generation: Given context u<t and model π , sample N candidate sentences from the natural model
Figure 3. Overall framework of SAM ARK.
Algorithm 1: SAM ARK Watermark Generation Input : LLM π ; context u<1 ; embedding model E ; private key k; sentences T ; channels c; budget N ; κ; ϵ; λdiv , λnov , θngram , θsem Output : Generated sentences u1 , . . . , uT 1 Derive pivot vectors V = {v1 , . . . , vc } and flags R = {r1 , . . . , rc } from k; 2 H ← ∅; V<1 ← vocab(u<1 ); 3 for t ← 1 to T do 4 Sample W = {x1 , . . . , xN } with xi ∼ pπ (· | u<t ); 5 W ← {x ∈ W | ρngram (x) < θngram }; 6 W ← {x ∈ W | ρsem (x) < θsem }; 7 Vmatch ← {x ∈ W | ∀j : sgn(cos(E(x), vj )) = rj }; 8 foreach x ∈ Vmatch P do 9 Swm (x) ← cj=1 tanh(κ · rj · cos(E(x), vj )); 10 S(x) ← Swm (x) + λdiv D(x) + λnov N (x); 11 end P 12 q(x) ← exp(ϵ · S(x))/ x′ exp(ϵ · S(x′ )); 13 Sample ut ∼ q(·); H ← H ∪ {ut }; 14 end 15 return u1 , . . . , uT ;
distribution to form the pool W = {x1 , . . . , xN }, where xi ∼ pπ (· | u<t ). • Embedding and Channel Matching: Extract semantic embeddings E(x) for all x ∈ W . Filter W to retain only candidates whose similarity signs strictly match the target pattern R across all c channels, yielding the matched subset: Vmatch = {x | sgn(⟨E(x), vj ⟩) = rj , ∀j ∈ {1, . . . , c}}. (2) • Hyperbolic Scoring: For each x ∈ Vmatch , compute the signed cosine similarity per channel σj (x) = rj · cos(E(x), vj ). We apply a hyperbolic tangent transform to amplify candidates with strong channel alignment
while suppressing near-zero noise: Swm (x) =
c X
tanh(κ · σj (x)),
(3)
j=1
where κ > 0 is a sharpness parameter controlling the amplification strength (default κ = 30). The tanh function saturates at ±1, ensuring that candidates with large |σj (x)| contribute maximally while those with weak alignment are suppressed. The final score incorporates diversity regularization (detailed in Section 3.4): S(x) = Swm (x) + λdiv · D(x) + λnov · N (x),
(4)
where D(x) and N (x) are the semantic diversity and vocabulary novelty terms, respectively. • Softmax Selection: Rather than deterministic top-k selection [11], we employ a softmax distribution over the matched candidates to introduce controlled stochasticity: exp(ϵ · S(x)) , ′ x′ ∈Vmatch exp(ϵ · S(x ))
q(x) = P
(5)
where ϵ > 0 is a temperature parameter. The watermarked sentence ut is then sampled according to ut ∼ q(·). In Figure 4, we display the influence of hyperbolic scoring under the Doc-P I attack. Compared with naive cosine scoring in previous SWM methods, hyperbolic scoring prevents the concentration on the boundary of the green regions.
3.3. SAM ARK Detector: Majority-Vote Blind Detection We introduce a blind, sentence-level detection scheme that extracts watermark evidence across multiple channels without prior knowledge of the target flags R. The detection process mirrors the generation-side hyperbolic transform for consistency.
generation: Ai,j = tanh(κ · Ci,j · r̂j ),
(7)
where Ai,j measures the evidence strength of the i-th sentence in the j -th channel. Similarly, this transform amplifies strong watermark signals while suppressing noise from weakly aligned sentences. • Robust Detection via z -Test: Treat the transformed alignment matrix A as a flattened distribution of n · c samples. The global z -statistic is computed as: Figure 4. Multi-channel semantic deviation under paraphrasing attacks.
Algorithm 2: SAM ARK Watermark Detection Input : Text X ; embedding model E ; private key k; channels c; sharpness κ; threshold τ Output : True (watermarked) or False 1 Segment X into sentences S = [s1 , . . . , sn ]; 2 Derive pivot vectors V = {v1 , . . . , vc } from k ; 3 for i ← 1 to n do 4 for j ← 1 to c do 5 Ci,j ← cos(E(si ), vj ); 6 end 7 end 8 for j ← 1 to c do Pn 9 r̂j ← sgn i=1 Ci,j ; 10 end 11 for i ← 1 to n do 12 for j ← 1 to c do 13 Ai,j ← tanh(κ · Ci,j · r̂j ); 14 end 15 end q P P 1 1 2 16 Ā ← nc i,j Ai,j ; σ̂A ← i,j (Ai,j − Ā) ; nc √ 17 z ← Ā · nc / σ̂A ; 18 return (z > τ );
(8)
3.4. Diversity-Aware Generation While the watermark scoring mechanism in Eq. 3 ensures strong detectability, greedily selecting high-scoring candidates may lead to repetitive or semantically monotonous text [11], [12]. To maintain generation quality, we introduce a two-stage diversity control mechanism: a hard filtering stage that removes overly similar candidates, followed by soft regularization terms that encourage diverse selections. Such additional optimization ensures the diversity and quality of generated text, avoiding quality degradation resulting from the strong sampling constraints.
Sentence Segmentation: Segment the input text into a sequence of sentences S = [s1 , . . . , sn ]. • Embedding and Channel Response: Extract embeddings E(si ) and deterministically reconstruct the pivot vectors V = {v1 , . . . , vc } using the shared key. Compute the channel response matrix C ∈ Rn×c : (6)
Blind Flag Inference: Since the detector has no access to the true flags R, we infer them via majority voting over the directional responses. For each channel j , aggregate the responses sentences to estimate the Pnacross all flag as r̂j = sgn C . Under the watermarking i,j i=1 hypothesis, the majority of sentences will have been selected to align with the true flag pattern, making this inference reliable. • Score Alignment with Hyperbolic Transform: Align the raw channel responses using the inferred flags and apply the same hyperbolic transform used during •
Ā 1 X √ , where Ā = Ai,j , nc i,j σ̂A / nc s 1 X σ̂A = (Ai,j − Ā)2 . nc i,j
The text is classified as watermarked if z exceeds a predefined confidence threshold τ .
•
Ci,j = cos(E(si ), vj ).
z=
3.4.1. Hard Filtering. Before scoring, we apply two sequential filters to the candidate pool W : • N-gram Overlap Filter: For each candidate x, we compute the fraction of its n-grams (default n = 4) that already appear in the generated context u<t . Let Gn (x) denote the set of n-grams in x and Gn (u<t ) denote those in the context. The overlap ratio is: ρngram (x) =
|Gn (x) ∩ Gn (u<t )| . |Gn (x)|
(9)
Candidates with ρngram (x) ≥ θngram are filtered out, where θngram ∈ (0, 1] is the overlap threshold. • Semantic Similarity Filter: For each remaining candidate, we compute its maximum cosine similarity to any previously selected sentence. Let H = {u1 , . . . , ut−1 } be the set of previously generated sentences with embeddings {E(ui )}. The semantic similarity is: ρsem (x) = max cos(E(x), E(u)). u∈H
(10)
Candidates with ρsem (x) ≥ θsem are filtered out, where θsem ∈ (0, 1] is the similarity threshold.
3.4.2. Soft Regularization. For candidates passing the hard filters, we augment the watermark score with two diversitypromoting terms: • Semantic Diversity Bonus: We reward candidates that are semantically dissimilar to previously selected sentences: D(x) = 1 − ρsem (x) = 1 − max cos(E(x), E(u)). (11) u∈H
This term ranges in [0, 1], with higher values indicating greater semantic novelty. • Vocabulary Novelty Bonus: We encourage candidates that introduce new vocabulary. Let V(x) denote the set of unique words in x and V<t denote the accumulated vocabulary from the context. The novelty score is: N (x) =
|V(x) \ V<t | , |V(x)|
TABLE 2. R ESULTS ON BOOKSUM. W E REPORT TP@FP1%, PAIRWISE LLM J UDGE W/L/T% AND AVG R ANK ( ∆ VS . UNWATERMARKED ). B OLD = BEST, UNDERLINED = SECOND - BEST. † DENOTES SAM ARK WITHOUT QUALITY OPTIMIZATION . Method
TP@FP1% Quality No Atk Doc-P I Doc-P II Doc-T PS-W PS-L PS-T Mistral-Small-3.1-24B-Base-2503
None – EXP 99.8 KGW 100.0 UPV 99.0 99.8 SynthID MorphMark 99.4 SemStamp 96.0 k-SemStamp 98.6 PMark 98.0 SAM ARK 98.0 † SAM ARK 98.7
– 38.2 64.0 61.4 23.8 56.0 49.8 61.7 51.5 90.5 88.7
None – EXP 99.8 KGW 100.0 UPV 99.4 99.8 SynthID MorphMark 100.0 97.0 SemStamp k-SemStamp 97.6 96.6 PMark SAM ARK 98.8 † SAM ARK 99.4
– 42.2 76.8 71.0 31.4 74.0 46.9 51.7 24.2 92.6 86.6
4. Experimental Results In this section, we conduct extensive experiments to answer the following research questions: (RQ1) How does SAM ARK perform under various PPAs? (RQ2) Can SAM ARK preserve generation quality in practice? (RQ3) What is the computational cost of SAM ARK compared with other SWM baselines? (RQ4) How sensitive is SAM ARK to its key components or parameters?
4.1. Experiment Setup Dataset and Baselines. Following previous work [6], [9], we evaluate SAM ARK on 500 samples from C4 [13] and BOOKSUM [14], using Llama-3.1-8B [15] and MistralSmall-3.1-24B-Base-2503 [16] as backbone models. Our baselines follow the official MarkLLM implementation [12], including token-level methods KGW [1], MorphMark [17], EXP [4], and SynthID [10], as well as semantic-level baselines SemStamp [6], k-SemStamp [7], and PMark [9]. For SAM ARK, we set the number of channels to 2 and the sample budget to N = 64. We report two variants: SAM ARK, which uses the full diversity-aware sampling and soft-regularization pipeline, and SAM ARK † , which disables these optimization terms. More implementation details are provided in Appendix A. Metrics. Following previous work, we assess watermark effectiveness in terms of detectability through TP@FP1%, TP@FP5%, AUC, and robustness under paragraph-level attacks, such as Paraphrase Attack Doc-P and Back-Translation Attack Doc-T by GPT-4.1-mini [18]. We use two paraphrasing prompts: Doc-P I, “Please rewrite the following text:”
– 17.2 34.4 23.6 10.4 34.2 39.8 43.1 57.5 88.1 89.0
– 29.6 54.4 38.0 12.6 45.8 58.6 65.9 77.0 87.1 90.3
– 52.4 38.0 47.2 54.2 47.6 53.2 51.4 57.2 47.9 33.0
– – 5.76 (+0.00) 46.2 1.4 5.56 (-0.20) 50.2 11.8 6.65 (+0.89) 51.4 1.4 6.12 (+0.35) 38.6 7.2 5.11 (-0.65) 51.4 1.0 6.08 (+0.32) 39.2 7.6 5.04 (-0.72) 47.2 1.4 4.94 (-0.82) 37.6 5.2 4.61 (-1.15) 45.2 6.9 5.14 (-0.62) 59.0 8.0 –
Nemotron-Nano-9B-v2-Base
(12)
representing the fraction of words in x that have not appeared in the generated text so far. The final selection score in Eq. 4 balances watermark strength with diversity through the weights λdiv and λnov . Setting these weights to zero recovers the pure watermarkdriven selection, while positive values encourage more varied and natural-sounding text.
Rank Avg (∆)
– 16.2 45.6 48.8 15.6 46.2 34.5 37.1 28.3 90.2 84.8
– 37.8 66.8 61.6 21.2 64.0 64.3 63.7 46.3 88.2 91.2
– 30.6 32.0 39.2 47.8 36.4 39.2 35.0 26.0 34.2 20.4
– – 5.06 (+0.00) 45.8 23.6 5.81 (+0.75) 42.4 25.6 5.97 (+0.91) 38.2 22.6 5.42 (+0.36) 33.4 18.8 4.38 (-0.67) 40.4 23.2 5.57 (+0.51) 41.6 19.2 5.24 (+0.18) 45.0 20.0 5.58 (+0.52) 49.8 24.2 6.22 (+1.16) 46.0 19.8 5.75 (+0.69) 56.4 23.2 –
and Doc-P II, “Please rewrite the following text, avoiding using the same words or phrases in the original text:”. We regard Doc-P II as the most representative and challenging scenario in practice. Appendix A.4 provides more details. Although perplexity (PPL) is widely used in prior work, it is insufficient for our setting: low-quality outputs with repeated sentences can receive artificially low PPL because repetitive patterns are easy for language models to predict. We therefore include three diversity-oriented reference metrics: Sentence Duplicate percentage (SD), which is lower when generation is less redundant; Distinct-2 (D-2), which is higher when lexical variety is greater; and 4-gram Repeat percentage (4g), which is lower when text is less repetitive. To evaluate text quality fairly, we use GPT-4.1-mini to conduct pairwise blind review between each watermarking method and the unwatermarked baseline for each sample, producing Win (PS-W), Lose (PS-L), and Tie (PS-T). Exact computation details are given in Appendix A.3.
4.2. Detectability, Robustness and Text Quality (RQ1 & RQ2) To answer RQ1 and RQ2, we comprehensively compare SAM ARK with seven widely used token-level watermarks and three semantic-level watermarks under various attacks. Tables 2 and 3 present results on BOOKSUM and C4 datasets respectively. Full results with additional metrics are provided in Appendix B. SAM ARK achieves dominant robustness under most attack scenarios. SAM ARK attains the highest detection rates across attack settings on both models and datasets.
TABLE 3. R ESULTS ON C4. W E REPORT TP@FP1% FOR DETECTION , PAIRWISE LLM J UDGE W/L/T% AND AVG R ANK FOR TEXT QUALITY. B OLD = BEST, UNDERLINED = SECOND - BEST. † DENOTES SAM ARK WITHOUT QUALITY OPTIMIZATION . Method
TP@FP1% Quality No Atk Doc-P I Doc-P II Doc-T PS-W PS-L PS-T
Rank Avg (∆)
Mistral-Small-3.1-24B-Base-2503 None – EXP 99.4 KGW 100.0 UPV 99.7 99.2 SynthID MorphMark 99.7 SemStamp 95.1 k-SemStamp 92.5 PMark 96.2 SAM ARK 94.5 † SAM ARK 95.2
– 24.6 77.7 67.1 44.1 55.5 28.6 22.5 40.0 78.6 78.8
None – EXP 100.0 KGW 100.0 UPV 99.7 100.0 SynthID MorphMark 99.8 96.4 SemStamp k-SemStamp 90.5 96.4 PMark SAM ARK 93.8 † SAM ARK 94.8
– 39.1 55.9 75.0 42.9 48.3 40.4 15.6 24.7 78.3 76.6
– 11.5 29.0 44.5 25.1 28.0 17.2 15.5 48.9 76.8 76.9
– 36.4 64.2 71.5 44.1 52.7 54.7 44.5 67.6 84.2 90.0
– 50.8 41.6 44.0 59.1 41.7 56.4 58.4 64.8 82.0 78.0
– – 5.69 (+0.00) 49.0 0.2 5.38 (-0.32) 57.8 0.6 6.56 (+0.87) 55.6 0.4 6.17 (+0.48) 40.5 0.4 4.64 (-1.05) 57.9 0.4 6.17 (+0.48) 43.6 0.0 5.19 (-0.50) 41.4 0.2 4.93 (-0.77) 35.0 0.2 4.17 (-1.52) 5.0 13.0 6.10 (+0.41) 6.0 16.0 –
Nemotron-Nano-9B-v2-Base – 16.9 27.3 53.2 22.6 20.4 27.9 14.6 28.3 72.9 73.8
– 58.6 56.2 79.5 53.0 49.0 61.7 32.1 45.0 82.3 83.8
– 36.7 39.6 42.2 54.8 45.0 52.4 39.2 40.0 69.4 28.0
– – 5.23 (+0.00) 58.4 5.0 6.21 (+0.98) 56.0 4.4 5.98 (+0.75) 53.2 4.6 5.64 (+0.41) 41.4 3.8 4.60 (-0.63) 50.8 4.2 5.76 (+0.53) 44.8 2.8 4.73 (-0.50) 56.2 4.6 5.56 (+0.33) 55.0 5.0 5.31 (+0.08) 5.2 25.4 5.98 (+0.75) 68.6 3.4 –
On Mistral with BOOKSUM under Doc-P II, SAM ARK achieves 88.1% TP@FP1%, compared with 57.5% for the next-best baseline, yielding a 30.6-point improvement. Similar advantages persist on Nemotron and C4. While UPV occasionally shows higher TP@FP5% in specific cases, AUC margins confirm SAM ARK’s stronger detection stability. Most baselines fail to maintain detectable signals under extreme paraphrasing, whereas SAM ARK preserves robust detection. The robustness advantage expands with stronger adversaries. SAM ARK’s performance gap over baselines widens as attack intensity increases. From Doc-P I to Doc-P II on Mistral-BOOKSUM, KGW drops by 29.6 points in TP@FP1%, while SAM ARK decreases by only 2.4 points. SynthID drops from 23.8% to 10.4%, whereas SAM ARK remains nearly constant. The same pattern appears across models: on Nemotron-C4, UPV decreases by 21.8 points between attack levels, while SAM ARK drops by only 5.4 points. This stability under escalating adversarial pressure indicates that semantic channel encoding preserves watermark signals even when surface-level features are substantially altered. SAM ARK maintains competitive text quality while achieving dominant robustness. Pairwise LLM-judge results show that SAM ARK achieves high win rates on C4 and outperforms all baselines, suggesting that sentencelevel filtering operation can introduce beneficial diversity. As shown in Figure 5, SAM ARK surpasses the robustness ceiling of existing methods while maintaining text quality no worse than the unwatermarked baseline. The AvgRank columns in Tables 2 and 3, obtained via GPT-4.1-mini
Figure 5. Trade-off between robustness and text quality on Mistral-Small3.1-24B-Base with C4. The x-axis reports the PS-W + PS-T (no worse than) rate.
blind ranking across all methods (including the unwatermarked baseline), support the same conclusion. On Mistral+BOOKSUM, SAM ARK achieves an AvgRank of 5.14 (∆ = −0.62), outperforming the unwatermarked baseline (5.76) and remaining comparable to SynthID (5.11). KGW consistently ranks worst across settings (∆ from +0.75 to +0.91), confirming that hard token-level constraints degrade fluency. Among semantic-level methods, SAM ARK ranks comparably to or better than SemStamp and k -SemStamp in most settings while delivering substantially higher robustness. On Nemotron, most watermarking methods rank above the unwatermarked baseline, suggesting that watermark-induced sampling diversity can occasionally improve generation quality. Overall, both pairwise and ranking evaluations indicate that SAM ARK’s robustness gains do not come at the expense of text quality. SAM ARK shows architecture-agnostic and distribution-agnostic consistency. SAM ARK maintains TP@FP1% above 72% under all attack scenarios across both backbone models, while baselines show high variance. Under Doc-P II, PMark drops by 29.2 points across models, whereas SAM ARK exhibits minimal fluctuation across datasets with different distributions. SAM ARK consistently achieves at least 97.0% AUC across all 16 attack-model-dataset combinations, and no baseline matches this uniformity. These results suggest that the self-anchored encoding strategy captures fundamental linguistic invariants rather than model-specific or domain-specific artifacts. Robustness under word-level attacks. Beyond paragraph-level paraphrasing, we further evaluate word-level perturbations that alter local lexical surface forms. Specifically, Word-S replaces a fraction of words with synonyms or context-compatible alternatives, while preserving most sentence-level semantics. As shown in Figure 6, existing semantic-level watermarks such as SemStamp, k -SemStamp, and PMark degrade substantially because their verifica-
TABLE 5. A BLATION STUDY ON DIVERSITY- AWARE FILTERING . E ACH ROW DISABLES ONE COMPONENT RESPECTIVELY.
Config Default w/o θngram w/o θsem w/o λdiv w/o λnov All Off
Figure 6. Word-S attack results.
tion relies on stable sentence segmentation and sentenceinternal structure. A similar trend appears under Word-D (Appendix B.3). Token-level methods also show a robustness– quality tension, since methods with better fluency tend to lose detectability faster as perturbation strength increases, while methods with stronger robustness incur larger quality loss. In contrast, SAM ARK remains more stable across perturbation types, because its signal is anchored to sentencelevel semantics rather than exact token realization. This result is consistent with Tables 2 and 3, and shows that SAM ARK mitigates the structural fragility of prior semantic-level baselines without inheriting the strongest quality penalties of robust token-level methods.
4.3. Efficiency Performance (RQ3)
SD%↓
Quality D-2↑
4g%↓
PS-W
0.27 1.35 1.25 0.10 0.71 7.65
0.825 0.792 0.797 0.776 0.762 0.570
4.96 8.31 7.55 7.26 8.70 29.11
47.9 48.8 47.5 45.0 46.3 33.0
LLM Judge PS-L PS-T 45.2 47.5 52.5 53.8 47.5 59.0
6.9 3.8 0.0 1.3 6.3 8.0
iterative context-hashing overhead required by SemStampfamily methods. Moreover, SAM ARK consumes the fewest sampled tokens per output token (47.44) and per sentence (1080.97), indicating that the diversity-aware filtering effectively reduces redundant sampling attempts. On the detection side, SAM ARK achieves a latency of only 0.0014s per token with negligible additional token consumption, as detection requires only a single forward pass through the embedding model followed by lightweight algebraic operations (majority voting and z -test). In contrast, PMark incurs 0.1861s per token and 1068.86 sampled tokens per sentence due to LLM-based re-generation, making SAM ARK’s detection over 130× faster.
4.4. Hyperparameter Sensitivity Analysis (RQ4) TABLE 4. C OMPUTATION OVERHEAD OF DIFFERENT METHODS . *: PM ARK INTRODUCES ADDITIONAL OVERHEAD FOR RECONSTRUCTING THE GREEN - RED THRESHOLD AT DETECTION . A BBREV.: L AT = LATENCY, T OK = TOKEN , S EN = OUTPUT SENTENCE , O UT = OUTPUT TOKEN . Method KGW SynthID MorphMark UPV EXP SemStamp k-SemStamp PMark SAM ARK
Lat/Tok 0.037 0.039 0.037 0.041 0.279 0.395 0.361 0.205 0.218
Generation Lat/Sen Tok/Out 0.91 1.00 0.81 1.00 0.87 1.00 0.85 1.00 5.71 1.00 7.58 64.50 6.65 65.05 4.63 49.73 4.61 47.44
Tok/Sen 24.52 20.78 23.31 20.47 21.06 1294.76 1255.72 1146.01 1080.97
Detection Lat/Tok Tok/Sen 0.0008 0.00 0.0007 0.00 0.0009 0.00 0.0001 0.00 0.0025 0.00 0.0063 0.00 0.0043 0.00 0.1861 1068.86∗ 0.0014 0.00
SAM ARK achieves the lowest overall computation overhead among semantic-level methods. We compare the computation overhead of SAM ARK and existing baselines on BOOKSUM with Mistral-Small-3.1-24B-Base-2503. Following the default MarkLLM configuration, token-level baselines are evaluated with the transformers backend, whereas semantic-level methods are evaluated with the vLLM backend. As shown in Table 4, token-level methods generally have lower generation latency because they modify token logits in a single decoding pass and do not perform sentencelevel candidate sampling. This lower latency, however, comes with the robustness limitations observed in Tables 2 and 3. Within the semantic-level group, SAM ARK achieves a generation latency of 0.22s per token and 4.61s per sentence, comparable to PMark and approximately 1.7× faster than SemStamp and k -SemStamp. This efficiency stems from the self-anchored design, which avoids the
To answer RQ4, we conduct a systematic sensitivity analysis on the key hyperparameters of SAM ARK using Mistral on BOOKSUM. We examine the four diversityrelated parameters, namely the semantic diversity weight λdiv , the vocabulary novelty weight λnov , the semantic similarity threshold θsem , and the n-gram overlap threshold θngram , as well as the sample budget N . For each parameter, we sweep over a range of values while holding the others at their defaults. Each diversity component contributes to text quality. Table 5 presents the ablation results where each diversity component is individually disabled. Removing the n-gram overlap filter raises the 4-gram repetition rate from 4.96% to 8.31% and the sentence duplicate rate from 0.27% to 1.35%. Disabling the semantic similarity filter produces a similar degradation, with the 4-gram repetition rate increasing to 7.55% and the sentence duplicate rate rising to 1.25%. Turning off the diversity weight λdiv reduces Distinct-2 from 0.825 to 0.776 and lowers the LLM judge win rate from 47.9% to 45.0%, while disabling the novelty weight λnov causes the largest drop in Distinct-2 to 0.762 and the highest 4-gram repetition rate among single-component ablations at 8.70%. When all four components are disabled simultaneously, the quality degradation compounds dramatically: the sentence duplicate rate surges to 7.65%, the 4-gram repetition rate reaches 29.11%, and the LLM judge win rate drops to 33.0%. These results confirm that the hard filtering and soft regularization mechanisms are complementary, each addressing a distinct aspect of text diversity.
TABLE 6. S ENSITIVITY TO DIVERSITY PARAMETERS ON M ISTRAL +BOOKSUM. D EFAULT VALUES ARE MARKED WITH ∗. λdiv
SD%↓
D-2↑
4g%↓
W%
λnov
SD%↓
D-2↑
4g%↓
W%
0.0 0.1 0.35∗ 0.7 1.0
0.10 0.45 0.27 0.83 0.62
0.78 0.78 0.82 0.83 0.83
7.26 7.67 4.96 5.16 5.40
45.0 47.5 47.9 57.5 60.0
0.0 0.1 0.2∗ 0.3 0.5
0.71 0.61 0.27 0.31 0.10
0.76 0.78 0.82 0.84 0.85
8.70 7.10 4.96 4.37 3.27
46.3 48.8 47.9 51.3 56.3
θsem
SD%↓
D-2↑
4g%↓
W%
θngram
SD%↓
D-2↑
4g%↓
W%
0.6 0.7 0.8∗ 0.9 1.0
0.71 0.10 0.27 0.52 1.25
0.84 0.84 0.82 0.80 0.80
4.73 3.35 4.96 7.51 7.55
46.3 48.8 47.9 48.8 47.5
0.2 0.3 0.4∗ 0.6 1.0
0.32 0.31 0.27 0.52 1.35
0.83 0.81 0.82 0.81 0.79
3.58 4.81 4.96 6.80 8.31
51.3 45.0 47.9 40.0 48.8
TABLE 7. E FFECT OF SAMPLE BUDGET N ON M ISTRAL +BOOKSUM.
N
64 128 200
Doc-P I
TP@FP1% Doc-P II
Doc-T
SD%↓
Quality D-2↑
4g%↓
93.1 100.0 97.0
88.8 93.8 95.0
90.6 93.8 90.5
0.27 0.52 0.08
0.82 0.88 0.84
4.96 1.53 4.49
Soft regularization weights exhibit a clear quality improvement trend. As shown in Table 6, increasing λdiv from 0 to 1.0 steadily improves Distinct-2 from 0.78 to 0.83 and raises the LLM judge win rate from 45.0% to 60.0%, confirming that the semantic diversity bonus effectively encourages varied sentence selection. Similarly, increasing λnov from 0 to 0.5 reduces the 4-gram repetition rate from 8.70% to 3.27% and improves Distinct-2 from 0.76 to 0.85, demonstrating that the vocabulary novelty bonus successfully promotes lexical variety. Both parameters show monotonic quality gains without degrading detection performance, as the watermark scoring mechanism in Eq. 3 remains the dominant component in the final selection score. Hard filtering thresholds control the quality floor. The semantic similarity threshold θsem and the n-gram overlap threshold θngram act as hard constraints that remove overly similar candidates before scoring. Relaxing θsem from 0.7 to 1.0 increases the 4-gram repetition rate from 3.35% to 7.55% and raises the sentence duplicate rate from 0.10% to 1.25%, as more semantically redundant candidates enter the scoring pool. A similar pattern holds for θngram : increasing it from 0.2 to 1.0 raises the 4-gram repetition rate from 3.58% to 8.31%. These results confirm that hard filtering provides a reliable quality floor by eliminating degenerate candidates early in the pipeline. Larger sample budgets improve both robustness and quality. Table 7 shows that increasing the sample budget N from 64 to 128 and 200 consistently improves detection rates under all attack scenarios. At N = 128, SAM ARK achieves 100.0% TP@FP1% under Doc-P I and 93.8% under Doc-P II, compared to 93.1% and 88.8% at N = 64. The quality metrics also benefit from larger budgets, as a richer candidate pool provides more opportunities to find sentences that simultaneously satisfy the watermark constraint and the diversity criteria. The 4-gram repetition rate drops from 4.96% at N = 64 to 1.53% at N = 128, and Distinct-2 improves from 0.82 to 0.88. We adopt N = 64 as the default
TABLE 8. A BLATION ON THE HYPERBOLIC TRANSFORM . “G EN ” AND “D ET ” INDICATE WHETHER tanh SCORING IS APPLIED DURING GENERATION AND DETECTION RESPECTIVELY.
Gen
Det
No Atk
Doc-P I
Doc-P II
Doc-T
✗ ✗ ✓ ✓
✗ ✓ ✗ ✓
94.0 95.2 99.8 99.4
70.6 75.2 94.8 94.8
67.4 68.8 93.2 92.8
49.0 48.8 95.2 94.0
to balance performance with computational cost, as discussed in Section 4.2. The hyperbolic transform during generation is the dominant factor for robustness. Table 8 isolates the contribution of the tanh scoring mechanism in generation and detection on Mistral+BOOKSUM. Without tanh in generation, detection rates under Doc-P II and Doc-T remain below 70%, regardless of whether tanh is applied during detection. Enabling tanh in generation alone boosts DocP II from 67.4% to 93.2% and Doc-T from 49.0% to 95.2%, a gain of more than 25 points. This improvement arises because the generation-side tanh transform actively selects candidates with stronger channel alignment, producing sentences whose watermark signals are more resilient to paraphrasing. Adding tanh during detection on top of tanh generation yields comparable results, confirming that the generation-side transform is the primary contributor. We retain tanh in both stages for pipeline consistency.
4.5. Case Study Score distribution analysis. Figures 7 show the same trend at the distribution level. For SemStamp and PMark, the attacked score distribution shifts toward the unwatermarked distribution, which increases overlap and weakens thresholdbased detection. For SAM ARK, attacked samples still remain clearly separated from unwatermarked samples, although their scores are lower than the original watermarked scores. This separation explains the higher robustness observed in the main results, where SAM ARK preserves a usable detection margin under aggressive paraphrasing. We also include certain specific cases in Figure 8 for reference.
5. Related Work In recent years, LLM watermarking techniques have advanced rapidly, with KGW [1] being a seminal contribution that embeds statistically detectable signals into text by introducing logit biases to pseudorandomly selected tokens. Following the taxonomy adopted in prior work, existing approaches can be broadly categorized into three types: (1) zero-bit watermarking, (2) multi-bit watermarking, and (3) semantic-level watermarking. Our work falls within the third category, while drawing inspiration from the other two.
Figure 7. Detection score distributions for unwatermarked, watermarked, and attacked samples on BOOKSUM with Mistral-Small-3.1-24B-Base-2503.
distributions [22], optimizing list distributions via semantic alignment to disperse similar words across lists [23], or increasing context-relevant word selection probability [24]. Beyond autoregressive LLMs, recent studies have also investigated order-agnostic watermarking for non-autoregressive paradigms [25], [26].
5.2. Multi-bit Watermarking
Figure 8. Case study of text generated by SAM ARK.
5.1. Zero-bit Watermarking The primary objective of zero-bit watermarking is to determine whether a given text is machine-generated, with KGW [1] being the most representative. Subsequent work optimizes the KGW framework in both detectability and text quality. Detectability. EWD [19] enhances sensitivity in low-entropy contexts (e.g., code) by prioritizing high-entropy tokens via entropy-based z -score weighting. WinMax [20] combats signal dilution in mixed texts using a sliding-window approach to dynamically compute multi-window z -scores and select maxima, boosting robustness. ITS and EXP [21] further enhance detectability by embedding a secret key sequence into tokens and computing alignment costs during detection to mitigate adversarial token manipulations. Text Quality. Existing methods mitigate quality degradation by either embedding watermarks in high-entropy, lowsemantic-impact positions using entropy-aware red-green list
Many applications require watermarks to convey richer information, such as user identifiers and timestamps, which zero-bit methods cannot support. Hence, another line of work focuses on embedding a multi-bit message (i.e., a binary string containing several bits). Existing solutions fall into two main categories: the first splits the vocabulary into distinct groups (like color categories) to encode data bits [27], and the second divides the text into chunks with each chunk holding part of the payload [28]. However, when either method partitions too finely (e.g., too many groups or tiny chunks), the watermark becomes weak and hard to detect. To address this, Yoo et al. [29] merge both approaches, avoiding extreme splitting while maintaining enough data capacity. More recently, Qu et al. [30] empirically observe that existing schemes suffer from either decoding efficiency or detection accuracy when encoding larger bit payloads, and propose a segmented construction to balance the two; Xu et al. [31] further refine payload robustness through majority-bit-aware aggregation. Another direction focuses on designing robust mechanisms that can trace content in settings with many adaptive users attempting to evade detection [32], establishing rigorous statistical guarantees for ultra-low false positive rates while extending the mechanism to multi-bit message embedding.
5.3. Semantic-level Watermarking The aforementioned methods operate primarily at the token level, making watermark signals vulnerable to adversarial rewriting such as paraphrasing. Sentence-level semantic watermarking (SWM) addresses this by embedding signals into sentence semantics, thereby offering robustness against lexical rewrites. A representative work is SemStamp [6], which extends the idea of prefix-hashing from KGW into the sentence semantic space. Specifically, it employs locality-sensitive
hashing [33] to compute a hash from the preceding sentence, which defines the “green” region for embedding the subsequent sentence. During detection, SemStamp counts the number of sentences whose embeddings fall within the corresponding green regions, conditioned on their preceding sentences, and leverages this statistic to perform a watermarkdetection test. A follow-up, k-SemStamp [7], mitigates the quality degradation caused by SemStamp’s rigid restriction to a single semantic partition by allowing sampling from the k nearest-neighbor partitions, thereby improving fluency and semantic preservation. Similarly, SemaMark [34] also relies on prefix hashing but adopts a Normalized Embedding Ring strategy. Beyond hash-based approaches, CoheMark [35] and SimMark [8] explore more flexible watermarking criteria using fuzzy c-means clustering or sentence similarity, while PersonaMark [36] hashes sentence structures for personalized embedding. PMark [9] addresses the distorted sentence distribution observed in prior methods and proposes a median-estimation-based approach to achieve distortion-free semantic-level watermarking with multi-channel constraints. Other recent efforts explore sparse autoencoders [37] and LLM-based paraphrasers [31] for sentence-level multi-bit embedding. However, existing SWM methods inherit KGW’s prefixbased design: the watermark signal in each sentence is pseudorandomly conditioned on its preceding context. Such dependence on sentence order makes them highly vulnerable to paragraph-level paraphrasing attacks that involve sentence reordering, splitting, or merging. Meanwhile, quality control in SWM remains underexplored, as simple n-gram filters fail to address semantic-level redundancy across sentences. Our work falls within the domain of semantic-level watermarking but is inspired by token-level designs that couple watermarks with a global secret key sequence [21], a concept also explored in prior works including undetectable watermarks [38], bi-level signatures [39], and publiclydetectable watermarks [40]. These approaches either operate at the token level or fail to maintain robustness under structural or paragraph-level perturbations. Meanwhile, although both our method and existing multi-bit watermarking approaches embed multi-bit-like signals into text, our goal is not to transmit a specific payload across the entire document; instead, we propose a self-anchored semanticlevel watermarking framework that severs the reliance on contextual order and incorporates diversity-aware filtering for quality preservation, pushing the Pareto frontier of the robustness-quality trade-off in text watermarking.
6. Limitations and Future Work Despite its strong paragraph-level paraphrase robustness, SAM ARK has several limitations. First, like other semanticlevel watermarking methods, it requires sampling multiple sentence candidates before selecting one that satisfies the target constraint, since current autoregressive LLMs are decoded token by token rather than sentence by sentence. This extra sampling loop makes generation latency higher
than that of token-level methods. Second, our diversityaware filtering improves text quality in practice but does not yet provide a formal distortion-free guarantee, because its hard filters and soft regularizers still modify the effective sampling distribution. Finally, our work focuses on zerobit watermarking, which embeds only a yes/no signal into generated text and is not directly applicable to multi-bit scenarios that require payload encoding. Several directions could address these limitations. On the efficiency side, emerging architectures such as diffusion language models and large concept models operate natively over sentence- or concept-level units and may provide a more direct interface for semantic watermarking, removing the need for repeated candidate sampling; complementary techniques such as steering generation could further guide the model toward valid candidates in a single pass. On the distortion side, a deeper theoretical understanding of the geometry of semantic embedding spaces, beyond the empirically motivated hyperbolic transform used here, could inform sampling strategies that remain robust to paragraphlevel paraphrasing while achieving a formal distortion-free guarantee. For the multi-bit extension, the self-anchored partition can be generalized from a binary green/red split to a multi-way partition of the semantic space, allowing each sentence to carry several payload bits while preserving robustness to paraphrasing. We leave these as future work.
7. Conclusion Current token-level and semantic-level watermarking methods rely on context-aware random seeders or predefined private keys during generation. However, this dependency leaves them highly vulnerable to paragraph-level paraphrasing attacks that involve word substitution and sentence permutation, severely compromising watermark traceability in adversarial settings. To address this, we introduce selfanchored watermarking, a concept in which the green region at timestep t is determined exclusively by the semantics of the t-th sentence. By removing reliance on contextual order, this design improves resilience to global paraphrasing attacks. To the best of our knowledge, SAM ARK is the first watermarking framework to achieve robustness against paragraph-level paraphrasing. Experimental results show that our approach consistently surpasses existing SWM baselines in robustness while maintaining competitive generation quality, establishing a more reliable paradigm for semanticlevel watermarking.
LLM Usage Considerations We used AI assistants for two purposes: (1) generating routine code and boilerplate functions, which were subsequently reviewed and debugged by humans, and (2) performing grammatical review and sentence-level editing of the manuscript. The research methodology, findings, and analysis were independently proposed and conducted.
Ethics Considerations This work studies text watermarking for identifying AIgenerated content. Our experiments use publicly available datasets and generated model outputs, and do not involve recruiting human subjects or collecting personal information. Potential risks include false-positive detections and misuse of watermark detectors for unsupported attribution decisions. We therefore report low-FPR detection metrics and emphasize that watermarking evidence should be interpreted as a statistical signal rather than definitive proof of authorship.
References [1]
J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” in International Conference on Machine Learning. PMLR, 2023, pp. 17 061–17 084.
[2]
X. Zhao, P. Ananth, L. Li, and Y.-X. Wang, “Provable robust watermarking for ai-generated text,” arXiv preprint arXiv:2306.17439, 2023.
[3]
Z. Hu, L. Chen, X. Wu, Y. Wu, H. Zhang, and H. Huang, “Unbiased watermark for large language models,” arXiv preprint arXiv:2310.10669, 2023.
[20] J. Kirchenbauer, J. Geiping, Y. Wen, M. Shu, K. Saifullah, K. Kong, K. Fernando, A. Saha, M. Goldblum, and T. Goldstein, “On the reliability of watermarks for large language models,” arXiv preprint arXiv:2306.04634, 2023. [21] R. Kuditipudi, J. Thickstun, T. Hashimoto, and P. Liang, “Robust distortion-free watermarks for language models,” arXiv preprint arXiv:2307.15593, 2023. [22] B. Wouters, “Optimizing watermarks for large language models,” arXiv preprint arXiv:2312.17295, 2023. [23] L. Chen, Y. Bian, Y. Deng, D. Cai, S. Li, P. Zhao, and K.-F. Wong, “Watme: Towards lossless watermarking through lexical redundancy,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024, pp. 9166– 9180.
[4]
S. Aaronson, “Simons institute talk on watermarking of large language models, 2023,” URL https://simons.berkeley.edu/talks/scott-aaronsonut-austin-openai-2023-08-17, 2023.
[5]
M. Christ and S. Gunn, “Pseudorandom error-correcting codes,” in Annual International Cryptology Conference. Springer, 2024, pp. 325–347.
[6]
A. B. Hou, J. Zhang, T. He, Y. Wang, Y.-S. Chuang, H. Wang, L. Shen, B. Van Durme, D. Khashabi, and Y. Tsvetkov, “Semstamp: A semantic watermark with paraphrastic robustness for text generation,” arXiv preprint arXiv:2310.03991, 2023.
[7]
A. B. Hou, J. Zhang, Y. Wang, D. Khashabi, and T. He, “k-semstamp: A clustering-based semantic watermark for detection of machinegenerated text,” arXiv preprint arXiv:2402.11399, 2024.
[26] L. Wu, L. Zhong, W. Qu, Y. Li, Y. Liu, S. Zhai, C. Shen, and J. Zhang, “Dmark: Order-agnostic watermarking for diffusion large language models,” arXiv preprint arXiv:2510.02902, 2025.
[8]
A. Dabiriaghdam and L. Wang, “Simmark: A robust sentence-level similarity-based watermarking algorithm for large language models,” arXiv preprint arXiv:2502.02787, 2025.
[9]
J. Huo, S. Liu, B. Wang, J. Zhang, Y. Yan, A. Liu, X. Hu, and M. Zhou, “PMark: Towards robust and distortion-free semanticlevel watermarking with channel constraints,” in The Fourteenth International Conference on Learning Representations, 2026. [Online]. Available: https://openreview.net/forum?id=EhDgP69DJG
[27] P. Fernandez, A. Chaffin, K. Tit, V. Chappelier, and T. Furon, “Three bricks to consolidate watermarks for large language models,” in 2023 IEEE international workshop on information forensics and security (WIFS). IEEE, 2023, pp. 1–6.
[10] S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, J. Welbl, V. Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicova et al., “Scalable watermarking for identifying large language model outputs,” Nature, vol. 634, no. 8035, pp. 818–823, 2024. [11] E. Giboulot and T. Furon, “Watermax: breaking the llm watermark detectability-robustness-quality trade-off,” Advances in Neural Information Processing Systems, vol. 37, pp. 18 848–18 881, 2024. [12] L. Pan, A. Liu, Z. He, Z. Gao, X. Zhao, Y. Lu, B. Zhou, S. Liu, X. Hu, L. Wen et al., “Markllm: An open-source toolkit for llm watermarking,” arXiv preprint arXiv:2405.10051, 2024. [13] C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,” Journal of machine learning research, vol. 21, no. 140, pp. 1–67, 2020.
[24] Y. Fu, D. Xiong, and Y. Dong, “Watermarking conditional text generation for ai detection: Unveiling challenges and a semanticaware watermark remedy,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 16, 2024, pp. 18 003–18 011. [25] R. Chen, Y. Wu, Y. Chen, C. Liu, J. Guo, and H. Huang, “A watermark for order-agnostic language models,” in International Conference on Learning Representations, vol. 2025, 2025, pp. 4372–4388.
[28] L. Wang, W. Yang, D. Chen, H. Zhou, Y. Lin, F. Meng, J. Zhou, and X. Sun, “Towards codable watermarking for injecting multi-bits information to llms,” arXiv preprint arXiv:2307.15992, 2023. [29] K. Yoo, W. Ahn, and N. Kwak, “Advancing beyond identification: Multi-bit watermark for large language models,” in Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), 2024, pp. 4031–4055. [30] W. Qu, W. Zheng, T. Tao, D. Yin, Y. Jiang, Z. Tian, W. Zou, J. Jia, and J. Zhang, “Provably robust multi-bit watermarking for {AI-generated} text,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 201–220. [31] X. Xu, J. Jia, Y. Yao, Y. Liu, and H. Li, “Robust multi-bit text watermark with llm-based paraphrasers,” arXiv preprint arXiv:2412.03123, 2024. [32] A. Cohen, A. Hoover, and G. Schoenbach, “Watermarking language models for many adaptive users,” in 2025 IEEE Symposium on Security and Privacy (SP). IEEE, 2025, pp. 2583–2601.
[14] W. Kryściński, N. Rajani, D. Agarwal, C. Xiong, and D. Radev, “Booksum: A collection of datasets for long-form narrative summarization,” arXiv preprint arXiv:2105.08209, 2021.
[33] P. Indyk and R. Motwani, “Approximate nearest neighbors: towards removing the curse of dimensionality,” in Proceedings of the thirtieth annual ACM symposium on Theory of computing, 1998, pp. 604–613.
[15] A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan et al., “The llama 3 herd of models,” arXiv e-prints, pp. arXiv–2407, 2024.
[34] J. Ren, H. Xu, Y. Liu, Y. Cui, S. Wang, D. Yin, and J. Tang, “A robust semantics-based watermark for large language model against paraphrasing,” arXiv preprint arXiv:2311.08721, 2023.
[16] Mistral AI, “Mistral small 3.1: The best model in its weight class,” Mistral AI, Tech. Rep., 2025. [Online]. Available: https: //mistral.ai/news/mistral-small-3-1
[35] J. Zhang, S. Liu, A. Liu, Y. Gao, J. Li, X. Gu, and X. Hu, “Cohemark: A novel sentence-level watermark for enhanced text quality,” arXiv preprint arXiv:2504.17309, 2025.
[17] Z. Wang, T. Gu, B. Wu, and Y. Yang, “Morphmark: Flexible adaptive watermarking for large language models,” arXiv preprint arXiv:2505.11541, 2025.
[36] Y. Zhang, P. Lv, Y. Liu, Y. Ma, W. Lu, X. Wang, X. Liu, and J. Liu, “Personamark: Personalized llm watermarking for model protection and user attribution,” arXiv preprint arXiv:2409.09739, 2024.
[18] OpenAI, “ChatGPT,” 2022. [Online]. Available: https://openai.com/ blog/chatgpt [19] Y. Lu, A. Liu, D. Yu, J. Li, and I. King, “An entropy-based text watermarking detection method,” arXiv preprint arXiv:2403.13485, 2024.
[37] Z. Yu, X. Jiang, W. Gu, Y. Wang, Q. Wen, S. Zhang, and W. Ye, “SAEMark: Steering personalized multilingual LLM watermarks with sparse autoencoders,” in The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2026. [Online]. Available: https://openreview.net/forum?id=tXnyVPNOfa
[38] M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” in The Thirty Seventh Annual Conference on Learning Theory. PMLR, 2024, pp. 1125–1139. [39] T. Zhou, X. Zhao, X. Xu, and S. Ren, “Bileve: Securing text provenance in large language models against spoofing with bi-level signature,” Advances in Neural Information Processing Systems, vol. 37, pp. 56 054–56 075, 2024. [40] J. Fairoze, S. Garg, S. Jha, S. Mahloujifar, M. Mahmoody, and M. Wang, “Publicly-detectable watermarking for language models,” arXiv preprint arXiv:2310.18491, 2023. [41] A. Liu, L. Pan, X. Hu, S. Li, L. Wen, I. King, and P. S. Yu, “An unforgeable publicly verifiable watermark for large language models,” arXiv preprint arXiv:2307.16230, 2023. [42] N. Reimers and I. Gurevych, “Sentence-bert: Sentence embeddings using siamese bert-networks,” in Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, 11 2019. [Online]. Available: https://arxiv.org/abs/1908.10084 [43] J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al., “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774, 2023.
Appendix A. Experiment Setup Details A.1. Baselines MarkLLM. We use the official MarkLLM implementation [12]1 to reproduce the results of various token-level baselines, including KGW [1], UPV [41], MorphMark [17], EXP [4], and SynthID [10]. During generation, we set max_new_tokens to 256, which is comparable to the generation length used by semantic-level methods. The temperature and top_p are fixed at 0.7 and 0.95, respectively, across all experiments to ensure a fair comparison. In addition, for baselines that depend on external networks (e.g., UPV [41]), we use the official weights provided by MarkLLM. k -SemStamp. We adapt the official k -SemStamp implementation from MarkLLM to align it with other semanticlevel methods. Specifically, we set max_new_sentences to 12 (instead of a token count), and apply this setting consistently across all semantic-level baselines. We set max_trials to the default value of 100 for SemStamp and k -SemStamp. For the embedding model, we use the fine-tuned all-mpnet-base-v2 [42]2 provided by [7]. We also use the k -means centroid weights3 released by [7], trained on the C4 [13] and BookSum [14] datasets. All other hyperparameters are kept at their default settings in the k -SemStamp implementation of MarkLLM. SemStamp. For SemStamp [6], we use the authors’ official implementation, setting temperature = 0.7, top_p = 0.95, and max_new_sentences = 12 to match the other semantic-level methods. We also use the fine-tuned embedding model for a fair comparison. 1. https://github.com/THU-BPM/MarkLLM 2. https://huggingface.co/AbeHou/SemStamp-c4-sbert 3. https://github.com/abehou/SemStamp
PMark. For PMark [9], we use the authors’ official implementation of the online PMark variant, setting temperature = 0.7, top_p = 0.95, and max_new_sentences = 12 to match the other semantic-level methods, with all-mpnet-base-v2 as the embedding model. The channel number is set to 4, and the sample budget is N = 64. SAM ARK. During generation, we use the original all-mpnet-base-v2 embedding model [42]4 without fine-tuning. Pivot vectors are generated via QR decomposition of a Gaussian random matrix to ensure orthogonality. We set temperature = 0.7, top_p = 0.95, and max_new_sentences = 12, consistent with other semantic-level methods. The sample budget is N = 64, and the number of channels is b = 2.
A.2. Prompt Templates We summarize the prompt templates used in the evaluation pipeline. Doc-T. The back-translation attack uses two translation prompts: • EN→ZH: “Translate the following text from English to Chinese. Only output the translation, nothing else:” • ZH→EN: “Translate the following text from Chinese to English. Only output the translation, nothing else:” LLM pairwise judge. For blind ranking, we use pairwise comparison with dataset-specific system prompts: • booksum: “Compare Summary A/B by accuracy, completeness, coherence, writing quality, and absence of obvious errors.” • c4: “Compare Continuation A/B by topical relevance, coherence, writing quality, informativeness, and absence of obvious errors.” Both settings require JSON-only output, as shown in Figure 9.
Figure 9. Output template for the LLM pairwise judge.
For example, the pairwise user query template of booksum is shown in Figure 10.
Figure 10. Pairwise user query template for booksum.
To ensure blind evaluation, watermarked and unwatermarked texts are assigned to A/B in randomized order for 4. https://huggingface.co/sentence-transformers/all-mpnet-base-v2
each sample, and final win/lose/tie is mapped back to the watermarked side. LLM ranking prompts. For multi-method blind ranking, we evaluate multiple candidates (A/B/C/...) jointly with dataset-specific system prompts: • booksum: “Rank all summaries by accuracy, completeness, coherence, writing quality, and absence of obvious errors.” • c4: “Rank all continuations by topical relevance, coherence, writing quality, informativeness, and absence of obvious errors.” The output is constrained to JSON, as shown in Figure 11, where the first element is best. Ties are explicitly allowed using entries such as "A=B".
For instance, the ranking query template of booksum is shown in Figure 12.
Figure 12. Ranking user query template for booksum.
For each sample, method outputs are first randomly mapped to blind labels A/B/C/..., then mapped back after parsing.
A.3. Quality Metrics For each generated sample x, we compute three automatic diversity metrics in addition to the pairwise LLM judge. Let S(x) denote the sequence of normalized sentences in x after sentence tokenization, trimming, and lowercasing, and let Gn (x) denote the sequence of word n-grams obtained after lowercasing and whitespace tokenization. Sentence Duplicate percentage (SD) is the fraction of generated sentences that duplicate an earlier sentence in the same output: (13)
| uniq(G2 (x))| . |G2 (x)|
4g(x) = 100 ×
|G4 (x)| − | uniq(G4 (x))| . |G4 (x)|
(15)
A.4. Attack Details Doc-P. We conduct document-level paraphrase attacks using GPT-4.1-mini [43]. Two prompt templates are used to instruct paraphrasing at different adversarial strengths. Attack Prompt I: “Please rewrite the following text:”; Attack Prompt II: “Please rewrite the following text, avoiding using the same words or phrases in the original text:”. All attacks are applied at the paragraph level across methods and settings to simulate real-world paragraph-level paraphrasing scenarios. Doc-T. We implement the back-translation attack following MarkLLM [12]. Specifically, we use GPT-4.1-mini to translate watermarked English text into Chinese and then back into English in an attempt to remove watermark evidence. Word-D and Word-S. We implement word deletion (Word-D) and synonym substitution (Word-S) attacks following the official MarkLLM implementation. We set the attack ratios to 5%, 15%, and 30% to evaluate the overall robustness of our method. We apply word-level attacks to the whole paragraph rather than sentence by sentence, unlike PMark [9]. Additional experimental results are reported in Appendix B.3.
Appendix B. Additional Experiments B.1. Full Results Tables 9 and 10 present the complete experimental results with all metrics.
B.2. Additional Robustness–Quality Trade-off Plots
Distinct-2 (D-2) measures bigram diversity: D-2(x) =
The 4-gram Repeat percentage (4g) measures repetitions beyond the first occurrence of each 4-gram:
If the denominator is zero, the corresponding metric is set to 0. We report the average of each metric over the evaluation set. Lower SD and 4g indicate less repetition, while higher D-2 indicates greater lexical diversity.
Figure 11. Output template for multi-method blind ranking.
|S(x)| − | uniq(S(x))| SD(x) = 100 × . |S(x)|
Figure 13. Word-D attack results.
(14)
In Figure 17, we display the robustness-quality trade-off plots for various backbones on BOOKSUM and C4.
TABLE 9. F ULL RESULTS ON BOOKSUM DATASET. F OR DETECTION , WE REPORT TP@FP=1%/TP@FP=5%/AUC (%). D OC -P DENOTES DOCUMENT- LEVEL PARAPHRASE ATTACK (GPT) WITH ATTACK P ROMPT I AND II; D OC -T DENOTES DOCUMENT- LEVEL TRANSLATION ATTACK (GPT). F OR TEXT QUALITY, WE REPORT S ENTENCE D UPLICATE % (SD, LOWER IS BETTER ), D ISTINCT-2 (D-2, HIGHER IS BETTER ), AND PAIRWISE LLM J UDGE W IN /L OSE /T IE % AGAINST UNWATERMARKED TEXT. B OLD = BEST, UNDERLINED = SECOND - BEST.
Method
No Atk
Detection Doc-P I Doc-P II
Doc-T(GPT)
Text Quality PS-W% PS-L%
SD%↓
D-2↑
8.9 9.5 0.4 0.2 0.2 0.7 10.2 4.0 0.1
0.761 0.756 0.948 0.910 0.942 0.928 0.770 0.788 0.816
53.2 51.4 38.0 54.2 47.6 47.2 52.4 57.2 47.9
39.2 47.2 50.2 38.6 51.4 51.4 46.2 37.6 45.2
7.6 1.4 11.8 7.2 1.0 1.4 1.4 5.2 6.9
15.9 17.9 0.1 0.1 0.2 0.4 16.7 15.1 0.6
0.687 0.696 0.941 0.897 0.937 0.916 0.686 0.732 0.746
39.2 35.0 32.0 47.8 36.4 39.2 30.6 26.0 34.2
41.6 45.0 42.4 33.4 40.4 38.2 45.8 49.8 46.0
19.2 20.0 25.6 18.8 23.2 22.6 23.6 24.2 19.8
PS-T%
Mistral-Small-3.1-24B-Base-2503 SemStamp [6] k-SemStamp [7] KGW [1] SynthID [10] MorphMark [17] UPV [41] EXP [4] PMark [9] SAM ARK (Ours)
96.0/98.0/99.5 98.6/99.6/99.9 100.0/100.0/100.0 99.8/99.8/100.0 99.4/99.8/100.0 99.0/99.4/98.7 99.8/99.8/100.0 98.0/98.4/99.4 98.0/99.6/99.8
49.8/64.3/91.1 61.7/78.8/94.1 64.0/84.0/96.6 23.8/47.2/80.8 56.0/78.6/94.7 61.4/77.0/85.7 38.2/57.4/86.8 51.5/66.7/89.9 90.5/97.9/99.5
SemStamp [6] k-SemStamp [7] KGW [1] SynthID [10] MorphMark [17] UPV [41] EXP [4] PMark [9] SAM ARK (Ours)
97.0/98.2/99.7 97.6/98.8/99.2 100.0/100.0/100.0 99.8/100.0/100.0 100.0/100.0/100.0 99.4/99.6/98.8 99.8/99.8/100.0 96.6/98.4/99.5 98.8/99.8/99.9
46.9/63.9/90.2 51.7/74.3/93.4 76.8/90.0/97.8 31.4/52.6/82.8 74.0/88.4/97.7 71.0/83.4/87.7 42.2/57.6/86.9 24.2/43.5/82.0 92.6/97.6/99.4
39.8/54.6/85.7 43.1/62.1/88.3 34.4/59.6/89.7 10.4/24.2/64.5 34.2/55.8/86.9 23.6/39.6/65.9 17.2/25.0/69.9 57.5/71.5/92.0 88.1/97.4/99.3
58.6/72.7/92.1 65.9/81.6/95.3 54.4/76.0/95.0 12.6/35.4/75.1 45.8/74.0/92.7 38.0/57.2/75.3 29.6/45.2/82.8 77.0/82.8/94.3 87.1/97.1/99.1
NVIDIA-Nemotron-Nano-9B-v2-Base 34.5/50.5/86.3 37.1/58.9/88.6 45.6/72.2/93.1 15.6/29.8/68.4 46.2/70.8/92.7 48.8/65.8/78.9 16.2/25.4/71.7 28.3/48.1/84.0 90.2/96.4/99.1
64.3/76.6/93.9 63.7/79.0/93.2 66.8/85.2/97.0 21.2/46.0/81.6 64.0/85.6/96.5 61.6/77.6/85.4 37.8/55.0/83.5 46.3/60.1/87.9 88.2/96.2/99.0
TABLE 10. F ULL RESULTS ON C4 DATASET. F OR DETECTION , WE REPORT TP@FP=1%/TP@FP=5%/AUC (%). D OC -P DENOTES DOCUMENT- LEVEL PARAPHRASE ATTACK (GPT) WITH ATTACK P ROMPT I AND II; D OC -T DENOTES DOCUMENT- LEVEL TRANSLATION ATTACK (GPT). F OR TEXT QUALITY, WE REPORT S ENTENCE D UPLICATE % (SD, LOWER IS BETTER ), D ISTINCT-2 (D-2, HIGHER IS BETTER ), AND PAIRWISE LLM J UDGE W IN /L OSE /T IE % AGAINST UNWATERMARKED TEXT. B OLD = BEST, UNDERLINED = SECOND - BEST.
Method
No Atk
Detection Doc-P I Doc-P II
Doc-T(GPT)
Text Quality PS-W% PS-L%
SD%↓
D-2↑
8.4 5.3 0.0 0.1 0.0 0.1 6.6 3.9 0.5
0.788 0.821 0.953 0.921 0.947 0.931 0.810 0.811 0.814
56.4 58.4 41.6 59.1 41.7 44.0 50.8 64.8 82.0
43.6 41.4 57.8 40.5 57.9 55.6 49.0 35.0 5.0
0.0 0.2 0.6 0.4 0.4 0.4 0.2 0.2 13.0
14.3 13.9 0.2 0.0 0.1 0.2 12.4 9.6 0.4
0.700 0.721 0.957 0.904 0.951 0.923 0.748 0.728 0.826
52.4 39.2 39.6 54.8 45.0 42.2 36.7 40.0 69.4
44.8 56.2 56.0 41.4 50.8 53.2 58.4 55.0 5.2
2.8 4.6 4.4 3.8 4.2 4.6 5.0 5.0 25.4
PS-T%
Mistral-Small-3.1-24B-Base-2503 SemStamp [6] k-SemStamp [7] KGW [1] SynthID [10] MorphMark [17] UPV [41] EXP [4] PMark [9] SAM ARK (Ours)
95.1/99.0/99.7 92.5/99.5/99.0 100.0/100.0/100.0 99.2/99.2/99.7 99.7/100.0/100.0 99.7/100.0/99.7 99.4/99.4/99.4 96.2/96.4/98.9 94.5/97.6/99.5
28.6/58.1/87.4 22.5/59.0/87.5 77.7/90.7/97.6 44.1/58.3/84.4 55.5/77.4/95.4 67.1/85.9/84.3 24.6/48.0/82.6 40.0/54.0/84.3 78.6/89.3/97.5
SemStamp [6] k-SemStamp [7] KGW [1] SynthID [10] MorphMark [17] UPV [41] EXP [4] PMark [9] SAM ARK (Ours)
96.4/98.0/99.0 90.5/99.2/98.2 100.0/100.0/100.0 100.0/100.0/100.0 99.8/100.0/100.0 99.7/100.0/99.8 100.0/100.0/99.8 96.4/97.8/98.8 93.8/97.0/99.2
40.4/54.8/87.4 15.6/49.2/84.4 55.9/80.3/96.0 42.9/59.9/84.1 48.3/71.4/93.8 75.0/91.7/87.9 39.1/50.3/83.4 24.7/39.7/78.9 78.3/90.6/97.2
17.2/31.0/73.2 15.5/40.2/79.8 29.0/47.2/88.3 25.1/37.2/69.9 28.0/51.4/89.2 44.5/74.6/75.2 11.5/22.7/70.5 48.9/60.4/86.4 76.8/87.5/97.0
54.7/77.8/92.1 44.5/74.5/91.1 64.2/84.5/96.3 44.1/59.4/83.6 52.7/76.8/95.8 71.5/92.8/85.8 36.4/60.4/88.0 67.6/73.8/92.8 84.2/93.0/98.3
NVIDIA-Nemotron-Nano-9B-v2-Base 27.9/44.2/78.4 14.6/40.3/81.1 27.3/49.9/88.6 22.6/35.0/69.0 20.4/41.5/85.8 53.2/79.2/77.7 16.9/25.1/69.7 28.3/40.0/79.3 72.9/89.2/97.1
61.7/71.6/90.6 32.1/65.7/88.4 56.2/80.6/96.2 53.0/69.3/87.6 49.0/78.1/95.3 79.5/94.6/88.0 58.6/70.6/90.2 45.0/57.4/86.1 82.3/93.8/97.8
B.3. Word-Deletion Attack Results
B.4. Illustration of SAMark Sampling Process
In Figure 13, we illustrate the results of various watermark methods under Word-D attacks.
In Figure 18, each point denotes one sampled nextsentence candidate si from a pool of size N . Let ei be its sentence embedding, eprev be the previous selected sentence embedding, and {vk }bk=1 be channel pivots with channel
Figure 14. Mistral + BOOKSUM
Figure 15. Nemotron + BOOKSUM
Figure 16. Nemotron + C4
Figure 17. Additional robustness–quality trade-off plots corresponding to the three settings not shown in the main text.
Figure 18. Illustration of the next-sentence sampling process of SAMark.
signs wk ∈ {−1, +1}. We define channel cosine values cik = cos(ei , vk ),
c̃ik = wk cik ,
(16)
and the quality score qi = cos(ei , eprev ).
(17)
The robustness score before and after hyperbolic transformation is b b X X riraw = c̃ik , ritanh = tanh(κ c̃ik ), (18) k=1
k=1
where κ is the tanh scale. Panel 1 plots (ci1 , ci2 ) for all candidates. Panel 2 applies the multi-channel green-red restriction and keeps candidates with matched channel signs (mask mgreen ). Panels 3–4 visui alize the quality-robustness trade-off (qi , ri ) with sampling probabilities pi ∝ exp(ϵri ), (19)
computed on active candidates under mgreen , using riraw in i tanh Panel 3 and ri in Panel 4. Panel 5 adds a hard filter mask mhard (e.g., overlap and i semantic-similarity constraints), and samples by phard ∝ exp ϵritanh 1[mhard ]. (20) i i Panel 6 adds soft regularization with diversity and novelty: rireg = ritanh + λdiv di + λnov ni , preg ∝ exp ϵrireg 1[mhard ], i i
(21)
where di = 1 − simi and ni is a lexical novelty bonus. The final selected sentence is the argmax under preg i .