arXiv CSopen access

A Survey on LLM Watermarking: Theory and Deployment

A Survey on LLM Watermarking: Theory and Deployment Huy Phan1 , Kieu Dang2 , Ojaswi Dulal2 , Aiham Al Shukairi2 , Abby Shine2 , Chase Garner2 , Phung Lai2 1

Truman State University, 2 University at Albany, State University of New York [email protected]

arXiv:2607.10103v1 [cs.CR] 11 Jul 2026

Abstract Large language models (LLMs) are increasingly embedded in high-impact workflows, yet their ability to generate fluent text at scale has amplified risks of provenance ambiguity, model misuse, and large-scale content laundering. LLM watermarking—embedding invisible signatures into model outputs—has emerged as a promising technical layer for attribution, auditing, and downstream trust decisions. However, the literature has grown rapidly and unevenly: existing categorizations often mix orthogonal design choices, making it difficult to compare methods, reason about guarantees, or translate research results into deployable systems. This survey provides a systematic, deploymentoriented review of LLM watermarking. We organize the space by the core questions practitioners must answer: where a watermark is embedded (generation-time vs. trainingtime, token vs. representation), who can detect it (public vs. private detection authority), what is assumed (access to logits, sampling control, secret keys, model ownership), and which threat models are targeted (paraphrasing, translation, summarization, style transfer, token manipulation, and adaptive removal). We synthesize the main families of techniques—including sampling biasing, codebased schemes, representation- and trainingbased approaches—and analyze their security–utility trade-offs through the lens of detectability, robustness, and distribution shift. We further review attack and evasion strategies, evaluation protocols and metrics (false positive control, calibration, robustness curves), and open challenges such as cross-model transfer, multi-modal pipelines, collusion, and governance constraints. Finally, we provide practical guidance for selecting watermark designs under real operational requirements and identify research directions needed for reliable, accountable LLM deployment.

1

Introduction

Large language models (LLMs), such as ChatGPT, Gemini, Claude, and Cohere (Google, 2024; OpenAI, 2024; Anthropic, 2024; Cohere, 2024), have demonstrated remarkable capabilities in text generation, machine translation, and knowledge understanding tasks (Zhang et al., 2023a,c; Xu et al., 2024; Hu et al., 2023; Kirchenbauer et al., 2023). They effectively mimic human writing behaviors and generate complex and coherent outputs from the input text, making it challenging to determine whether a text is authored by humans or generated by LLMs. Due to the high demands of computational resources and human efforts required for training LLMs (Brown et al., 2020; Chen et al., 2021), these models are commonly offered as a service through application programming interfaces (APIs), typically requiring users to pay or subscribe (Azure, 2021; Bluemix, 2021). Although users cannot access to the model weights or architectures of these commercial LLMs, this restriction does not ensure the safety of these models. Malicious actors can intentionally mimic cloud-hosted LLM behaviors to offer cheaper services (Wallace et al., 2020; Xu et al., 2022). To conduct this service stealing, an adversary can query a set of inputs through an LLM’s API to retrieve the corresponding outputs. Then, the adversary uses these input-output data to effectively fine-tune their local model. When the number of queries is sufficient to gather enough input-output data within a particular domain, the adversary can steal the cloud-hosted LLM behaviors in that domain (Victor and Efrati, 2023; Carlini et al., 2024; Conikee, 2024). Consequently, these concerns underscore significant risks regarding the intellectual property (IP) rights of the cloud-hosted proprietary LLMs (Li et al., 2023). To address such risks, service providers, i.e., the cloud, have employed many strategies including watermarks, encryption, limited model exposure

via APIs, and differential privacy (Kirchenbauer et al., 2023; Xue et al., 2022; Yu et al., 2021). Among them, watermarks (WMs) (Kirchenbauer et al., 2023; Yoo et al., 2024a; Liu et al., 2023; Christ et al., 2024; Kuditipudi et al., 2023a) have emerged as a practical tool for LLMs due to its ability to ensure traceability, protect IP, and detect misuse. Typically, WMs embed imperceptible patterns into the LLM outputs directly. These patterns can be used to trace the original text or determine whether the generated text from an LLM is watermarked, facilitating the detection of unauthorized use. To watermark outputs, the cloud can introduce bias into logits of token generations to favor a set of specific tokens or alter the token sampling process of LLMs. Once an WM is applied, the cloud can use IP checkers to determine if a set of outputs from a suspicious model is watermarked. This allows the cloud to assess whether the suspicious model has been trained or fine-tuned using the cloud’s watermarked outputs. Typically, IP checkers analyze the tokens and perform statistical tests to check if the values exceed certain thresholds, indicating that the cloud-hosted LLM has been imitated. WMs are effective in detecting IP violations. However, WMs can be susceptible to WM removal attacks (Zhang et al., 2024a; Pang et al., 2024a) or spoofing attacks (Pang et al., 2024a). These attacks either require significant computational resources for additional training to paraphrase the generated text of cloud-hosted LLMs or demand numerous queries to learn the distribution of WMs. While several studies have surveyed WMs on LLMs (Liu et al., 2024b; Liang et al., 2024b; Lalai et al., 2024), no research has systematically and extensively explored the effectiveness of WMs on LLMs, particularly regarding the impact of WMs on LLM utility and IP checkers, under both attack and attack-free environments. In addition, the practicality of WMs has not been rigorously assessed. Therefore, in this work, we aim to develop a comprehensive systematization of WMs in LLMs, with the following contributions: • We provide a structured overview of the risks associated with LLMs, spanning technical, robustness related dimensions. • We introduce a comprehensive taxonomy of watermarking techniques in LLMs, detailing their design principles, operational mechanisms, and effectiveness against attacks.

• We analyze adversarial threats to LLM watermarks and examine their impacts on reliability, utility, and downstream task performance. • We identify well-suited application scenarios for different watermarking families, outline their limitations, and compare their suitability across deployment contexts. • We discuss current challenges, open problems, and future research directions for developing trustworthy and practical watermarking systems for LLMs. Our study provides key insights into using WMs for protecting LLMs, addressing concerns related to their deployment and IP protection. Through extensive experiments across different WMs, LLMs, and IP checkers, our highlighted findings are: (1) WMs significantly enhance the uniqueness and distinctiveness of LLM outputs, showing their effectiveness in strengthening IP protection and reducing unauthorized usage; (2) The impact of WMs on model utility can be moderate to significant, varying based on WM types and LLM architectures, potentially influencing their suitability for real-world applications; and (3) Attacks targeting WMs impose a notable cost on model utility. In conclusion, due to their unfavorable impacts on model utility, WMs in LLMs are not ready for realworld deployments, highlighting the urgent need to improve WM resilience while maintaining model utility.

2

Large Language Models and Risks

2.1

Large Language Models

Large Language Models (LLMs) (Kasneci et al., 2023) are advanced artificial intelligence systems designed to understand, generate, and analyze human language. The term large typically refers to the scale of the training data, the number of model parameters, and the computational resources used during training. These models are trained on vast amounts of text data and are capable of learning complex linguistic patterns, including syntax, semantics, and contextual relationships. As a result, LLMs are able to perform a wide range of languagebased tasks that previously required significant human involvement. LLMs are built on the transformer architecture introduced by Vaswani (2017), which is heavily based on a mechanism known as self-attention.

This mechanism enables the model to evaluate relationships between all words in a sentence simultaneously, rather than processing text sequentially. Because self-attention supports parallel computation and models long-range dependencies effectively, transformer-based LLMs can scale to large datasets and parameter counts (Vaswani, 2017). Modern LLMs are trained using self-supervised learning techniques on extremely large text datasets. In practice, text is converted into tokens (subword units), and the model learns by predicting missing or next tokens in a sequence, allowing it to internalize grammatical structure, contextual relevance, and general language usage. LLMs vary in training objectives and usage: autoregressive models such as GPT generate text by predicting the next token, while masked-language models such as BERT learn bidirectional representations by predicting masked tokens in input sequences (Brown et al., 2020; Devlin et al., 2019). Prominent examples of LLMs include GPT-3 (Brown et al., 2020), BERT (Devlin et al., 2019), PaLM 2 (Anil et al., 2023), and GPT-4 (OpenAI, 2024). These models demonstrate strong performance in applications such as text summarization, machine translation, question answering, and conversational dialogue. This overview of LLM architecture and training establishes the technical foundation needed to evaluate their broader impacts and deployment considerations. 2.2

Risks of Large Language Models

Large Language Models (LLMs) comes with several well-known risks, many of which encouraged researchers to explore watermarking and other ways to identify where content comes from. Watermarking is not meant to fix every problem caused by Large Language Models (LLMs), but it is closely tied to several major concerns such as, unwanted memorization of training data, the spread of false information, questions of who is responsible for generated content, and verifying whether something was actually written by a human or a model. This section reviews the main risks related with LLMs and shows these issues create a clear need for watermarking methods. 2.2.1

Intellectual Property Risks and Memorization

Memorization is not just a rare problem in LLMs, but a common and ongoing risk.Carlini et al. (Carlini et al., 2021) show that LLMs can accidentally

repeat exact parts of their training data, including private or copyrighted text, which creates serious privacy and intellectual property concerns. Later research shows that this happens more often as models get bigger. Carlini et al. (Carlini et al., 2022) find that rare or unique training examples are especially easy to extract from models. Lee et al. (Lee et al., 2022) show that having repeated content in training data greatly increases the chance of leaking private information, and that removing duplicates helps but does not completely fix the problem. Earlier work by Song and Shmatikov (Song and Shmatikov, 2019) also shows that it is possible to recover information about training data from text-generation models, making it clear that privacy and copyright risks have existed for a long time. Overall, these studies show that memorization is a built-in risk of how LLMs are trained. While watermarking can help detect whether sensitive content was generated by an LLM, it cannot stop memorization itself, showing both the value and the limits of watermark-based approaches.

2.2.2

Misinformation and Harmful Content Generation

LLMs can write text that sounds smooth and confident, but the information is sometimes wrong, made up, or harmful. Past research shows that LLMs often produce false information while sounding very sure about it, a problem known as hallucination (Lin et al., 2021; Ji et al., 2023). In addition to being incorrect, LLMs can also generate toxic or harmful language, even when the input prompt is neutral (Gehman et al., 2020). Because of these risks, especially the spread of false and harmful content online, watermarking has been studied as a way to identify text written by AI. However, experiments show that watermarking does not work well in real situations. Sadasivan et al. (Sadasivan et al., 2023) show that simple changes like rewording, translating, or making small style edits can easily remove watermarks from AI-generated text. Other research suggests that it may not even be possible to create watermarking methods that survive these kinds of changes under certain conditions (Zhang et al., 2023b). As a result, even though watermarking is motivated by concerns about misinformation, current watermarking methods alone cannot fully stop the spread of false or harmful content from LLMs.

Figure 1: Overview of major risks associated with large language models, including intellectual property and memorization risks, misinformation and harmful content generation, authenticity and accountability challenges, security and model misuse, and broader societal and fairness concerns.

2.2.3

Authenticity, Attribution and Accountability

A big concern with LLMs is that it is hard to tell whether text was written by a person or generated by AI. Early research showed that tools that try to detect AI-written text using statistics are not reliable and can be easily tricked (Gehrmann et al., 2019; Zellers et al., 2019). Newer studies show this is still true for modern LLMs. Shen et al. (Shen et al., 2023) explain that detecting AI-generated text is very difficult because it can look almost exactly like human writing. This causes serious problems in areas like healthcare, education, journalism, and social media, where knowing who wrote something and who is responsible is important. Watermarking has been suggested as a way to help by adding hidden signals to AI-generated text (Kirchenbauer et al., 2023). However, watermarking has many of the same problems as older detection methods. If the text is rewritten or if the AI does not use watermarking, then it becomes impossible to know where the text came from. As Weidinger et al. (Weidinger et al., 2021) point out, this lack of accountability is a broader social risk of using LLMs. Because of this, concerns about trust and authorship strongly motivate watermarking research, even though current watermarking methods

cannot fully solve these problems.

2.2.4

Security and Model Misuse Risks

LLMs can be misused for harmful things like spam, fraud, propaganda, and social engineering. Because LLMs can produce large amounts of fluent text, they make it easier and cheaper to create misleading or manipulative content (Weidinger et al., 2021; Goldstein et al., 2023). Research also shows that even models built with safety protections can still be misused. Ganguli et al. (Ganguli et al., 2022) show that models can be pushed to generate harmful content despite these safeguards. These risks encourage the use of watermarking to help trace harmful AI-generated text back to its source. However, watermarking is not fully secure. Sadasivan et al. (Sadasivan et al., 2023) show that watermarks can be removed using simple changes like rewriting or translating the text. Newer semantic watermarking methods try to make watermarks stronger (Ren et al., 2024), but they still cannot fully stop attackers. Because of this, even though misuse concerns motivate watermarking research, current watermarking methods cannot fully prevent or control harmful uses of LLMs.

2.2.5 Broader Societal and Fairness Risks LLMs can cause wider social and fairness problems that watermarking cannot directly fix. Research shows that LLMs can repeat social biases, strengthen stereotypes, and generate harmful or offensive language (Bender et al., 2021; Bolukbasi et al., 2016). Studies also show that LLMs can produce toxic or abusive content even when given neutral prompts (Gehman et al., 2020). Weidinger et al. (Weidinger et al., 2021) explain many ethical and social harms linked to LLMs, including misinformation and harm to vulnerable groups. Watermarking can help show whether harmful content came from an AI system, but it does not stop biased or harmful text from being created. It can also raise fairness concerns of its own. For example, detection mistakes may unfairly punish some users or groups, and large-scale tracking of AIgenerated content can create privacy or surveillance risks (Blodgett et al., 2020). Overall, while watermarking may help with accountability, it cannot fully solve the larger fairness and ethical problems caused by LLMs. The main risks of LLMs such as memorizing sensitive data, spreading misinformation, creating accountability problems, and enabling misuse gives us a strong reasons to explore watermarking methods. But, research shows that watermarking has important limits and cannot fully fix these issues. Because of this, watermarking should be seen as just one helpful tool within a larger set of technical and policy measures needed to manage LLM risks.

3

Watermarking Techniques in LLMs

As LLMs become more capable of generating human-like natural text, it is really difficult to identify between human written and machine generated content and this challenge raises different concerns and watermarking has been proposed as a solution to these challenges. It works by embedding hidden, machine-detectable signals into generated text that are invisible to human readers and these signals can later be identified using different methods like statistical or cryptographic and a secret key, without affecting the quality of the text. Current watermarking techniques are grouped into two types based on when the watermark is added: in-processing watermarking, which is built into the text while it is being generated, and post-processing watermarking, which is applied after the text has already been

created. 3.1

In-processing Watermarking

In-processing watermarking adds hidden signals while a LLM is generating text. These methods guide the model’s token choices or semantic decisions during decoding, so the watermark becomes part of the generated text itself. This technique is usually stronger and produces fewer false positives because the watermark is built into the generation process. However, these methods require access to the model and control over how text is generated. One of the earliest and most important in-processing watermarking methods is proposed by (Kirchenbauer et al., 2023).The method splits words into two random groups, called “green” and “red,” using a secret key. When the model writes text, it gently prefers green words. This leaves a hidden pattern, or watermark, that can be found later. It works well if the text is only changed a little. But it is less reliable for very repetitive writing, and it can fail if someone rewrites the text or swaps words with similar ones. Several later studies improve this method with stronger theory. Zhao et al. (Zhao et al., 2024) study when watermarks can be reliably detected and show robustness against token-level attacks under high-entropy conditions. Hu et al. (Hu et al., 2024) further improve the method by keeping the original token distribution unchanged while still allowing reliable detection using statistical tests. These works show the trade-off between watermark strength, text quality, and how hidden the watermark is.To make watermarks more robust to text edits, Golowich and Moitra (Golowich and Moitra, 2024) propose a method that can survive insertions, deletions, and substitutions. Their approach spreads watermark information across the text so it can still be recovered after editing. This method does not require access to the model’s internals and only needs a secret key, making it practical for real-world use. Another group of methods focuses on meaning rather than exact words. These semantic watermarking approaches try to keep the watermark even after paraphrasing. Liu et al. (Liu et al., 2024c) propose a semantic-invariant watermark that uses additional language models to create semantic embeddings during generation. Sentence-level methods such as SemStamp (Hou et al., 2024a) and kSemStamp (Hou et al., 2024b) further improve robustness by enforcing semantic consistency, though they require more computation. Adaptive water-

marking methods change watermark strength depending on the text being generated. Liu and Bu (Liu and Bu, 2024) propose adding watermarks only when the model is uncertain (high entropy), which helps keep the text natural while still allowing detection. Other methods, such as invisible watermarking (Zhao et al., 2023a), hide signals without changing the output distribution and rely on secret keys for detection. These methods reduce false positives but do not work well on repetitive text. Finally, practical systems are studied by Dathathri et al. (Dathathri et al., 2024), who introduce SynthID, a system designed for largescale use. While efficient, SynthID is less robust to paraphrasing, translation, and short texts. Other approaches such as WaterMax (Zhao et al., 2023b) and ModelShield (Pang et al., 2025) explore different designs that trade extra computation or selfwatermarking prompts for better robustness. 3.2

Post-processing Watermarking

Post-processing watermarking adds watermarks after a language model has already produced text. It does not change how the model works internally or how it generates text. This makes these methods especially useful in black-box settings, where we cannot access or control the model itself and can only see its outputs. This is common for closed or proprietary systems such as GPT-4, Claude, or LLaMA-based APIs. Because post-processing works externally, it allows third parties to add or check watermarks for purposes like accountability, tracking where text comes from, and protecting content integrity in real-world use. One common type of post-processing watermarking uses lexical substitution, where words are replaced with other words that have the same meaning. He et al. (He et al., 2022) propose a method that protects the intellectual property of language generation APIs by making small, meaning-preserving changes, such as replacing words with synonyms or changing spellings. These small changes embed a watermark that can later be detected using statistical tests to check whether the text came from a specific system. This work shows that simple, humanreadable changes can support attribution without changing the model itself. Later work improves both robustness and meaning preservation by using contextual language models. Yang et al. (Yang et al., 2022) introduce a context-aware approach that embeds watermark bits using synonym options generated by BERT and checked by RoBERTa to

ensure the meaning stays the same. By considering the surrounding context instead of using fixed word lists, this method is more resistant to formatting changes, optical character recognition (OCR) errors, and paraphrasing. This makes it more suitable for tracking text as it moves through different processing steps. PostMark (Chang et al., 2024) further extends post-processing watermarking to fully black-box large language models. It rewrites generated text using semantically similar watermark words selected from a secret table. The watermark is added by an external language model, such as GPT-4, which acts as an inserter and keeps the text fluent and natural. This approach shows that reliable watermarking is possible even when there is no access to the original generation process. Post-processing watermarking has also been used to protect sensitive information. Xiang et al. (Xiang et al., 2024) propose a reversible watermarking method that identifies sensitive words and replaces them with context-appropriate alternatives. Watermark information is embedded using prediction error expansion, and the original text can later be fully recovered. Unlike attribution-focused methods, this approach focuses on safely modifying sensitive content while allowing exact restoration. Learning-based methods further expand what postprocessing watermarking can do. Munyer et al. (Munyer et al., 2024) introduce DeepTextMark, a system that uses deep learning to embed hidden watermarks through synonym substitution and detect them with a transformer-based classifier. Because embedding and detection are separate from the original text generation, this method can be easily added to later content analysis pipelines. Overall, watermarking helps indentify and track text generated by large language models. Some methods add watermarks during text generation, while others add them after the text is created and each techniques has strengths and limits but together they support responsible and trustworthy use of LLM-generated content.

4

Watermarking Techniques in LLMs

The distinguishability between human writing and machine generated text has been deteriorating slowly but surely over the past years since the rise of large language models. From its implementation in journalism, software development, and education watermarking techniques become more of a

necessity. Watermarking techniques address this challenge by embedding imperceptible, machineverifiable signals into the output of generative models, enabling subsequent detection and attribution. As opposed to the visible digital signature, textual watermarks operate within the linguistic structure itself. By altering token probabilities and substituting words on a semantic level, this method provides intellectual property protection, and forensic tracking, especially as generative models continue to scale and proliferate. In-Processing Watermarks. KGW (Kirchenbauer et al., 2023) uses a secret key and the preceding context to pseudorandomly divide the vocabulary into green and red lists, then applies a logit bias δ to green-list tokens, with γ controlling the expected green-list proportion. Although KGW is an influential early watermarking method, its detection performance may weaken for short or lowentropy outputs and under synonym substitution or paraphrasing attacks. Unigram-WM (Zhao et al., 2024) uses a fixed, context-independent vocabulary partition and provides theoretical robustness guarantees under bounded adversarial token edits while maintaining strong detection performance and generation quality; however, its fixed grouping may interact poorly with some lexical distributions and may be more predictable across contexts. SIR (Liu et al., 2024a) embeds watermark signals in semantic space by computing context embeddings and using a learned mapping network to produce consistent logit shifts for semantically similar phrases. This design improves paraphrase robustness, although performance may depend on the stability of the embedding model across domains and model versions. Adaptive-WM (Liu and Bu, 2024) identifies watermark-eligible positions using the entropy of the next-token distribution and applies adaptive semantic logit scaling or temperature adjustment only at suitable positions. It can preserve text quality and improve robustness, but it introduces additional computational overhead and may depend on auxiliary semantic or uncertainty-estimation models. Unbiased-WM (Hu et al., 2024) applies pseudorandom δ-reweighting or γ-reweighting while preserving the original token distribution in expectation. Although this property provides statistical undetectability under the method’s assumptions, the watermark can still be weakened by synonym substitution and paraphrasing attacks such as DIPPER (Krishna et al., 2024). UPV (Liu et al., 2023) uses a dual-model framework in which a private

keyed component modifies generation and a public neural detector allows third parties to verify the watermark without access to the secret key, original prompt, or underlying language model. This design supports scalable public verification, although detection may decline after extensive paraphrasing or cumulative edits. EXP (Kuditipudi et al., 2023b) uses keyed exponential minimum sampling and inverse-transform sampling to align token generation with a pseudorandom sequence while preserving the model’s output distribution under its theoretical assumptions. It can remain detectable after moderate token corruption, but its performance decreases for short outputs and low-entropy contexts. SynthID (Dathathri et al., 2024) uses a tournamentstyle sampling procedure to assign pseudorandom scores to candidate tokens and aggregates tokenlevel evidence through statistical methods such as mean-based or Bayesian scoring. It maintains low latency and strong generation quality, but detection becomes more difficult for short outputs and after substantial paraphrasing, translation, or rewriting. WaterMax (Giboulot and Teddy, 2024) generates several candidate outputs and selects the one with the strongest watermark score without directly changing the model’s logits, temperature, or base sampling strategy. It achieves strong detectability and robustness with limited quality loss, but requires multiple candidate generations and therefore increases computational cost. SemStamp (Hou et al., 2024a) encodes sentence-level semantic watermarks using sentence embeddings, localitysensitive hashing, and rejection sampling rather than token-level statistical signals. It is comparatively resilient to lexical substitutions and paraphrasing, although rejection sampling adds generation latency. k-SemStamp (Hou et al., 2024b) replaces SemStamp’s random hyperplane partitioning with k-means clustering over sentence embeddings to better capture the structure of semantic space and improve paraphrase resilience and detection robustness; however, its effectiveness depends on the quality and stability of the embedding and clustering models. Undetectable-WM (Christ et al., 2024) introduces a cryptographically motivated watermark that preserves the output distribution and requires sufficient empirical entropy for reliable detection. It can maintain generation quality and low false-positive rates, but its effectiveness weakens for short or low-entropy outputs. ModelShield (Pang et al., 2025) embeds self-watermarking signals into LLM outputs to support the detection

of unauthorized model extraction or imitation. It provides a practical defense without extensive retraining, although its effectiveness depends on the attack strategy, the amount of watermarked data collected by the adversary, and any transformations applied to the outputs. GINSEW (Zhao et al., 2023d) is not itself a watermarking method but a paraphrase-based adversarial framework that optimizes text to reduce watermark detection statistics while preserving semantic meaning. It provides a systematic robustness evaluation, although its findings may depend on the paraphrase model and watermarking methods considered. EDRW (Golowich and Moitra, 2024) primarily targets diffusion models rather than autoregressive text generation and embeds pseudorandom error-correcting information into diffusion-model latent representations to provide computational undetectability and robustness against selected transformations and adaptive queries. Its embedding capacity, deployment assumptions, and computational requirements therefore differ substantially from those of token-level LLM watermarking methods. Post processing watermarking methods modify text after generation rather than during model training. These methods share a common goal. They insert detectable signals while preserving meaning and fluency. Despite this shared goal, they differ in how tokens are selected and how signals accumulate. These design choices shape each method to stand in their own category. One class of approaches relies on semantic substitution guided by fixed reference dictionaries. POSTMARK (Chang et al., 2024) follows this design. It embeds a watermark by selecting a small portion of the final text, usually five to fifteen percent, as insertion targets. The system embeds the full output, compares it against a private table of 3,266 word embeddings, and ranks vocabulary entries by similarity. After a second semantic filter, an instruction following model inserts high scoring alternatives that preserve meaning. Detection repeats the embedding process and checks for selected words or close variants using a cosine similarity threshold near 0.7. The main advantage of semantic substitution lies in paraphrase robustness. Because the signal anchors to meaning, many surface edits fail to remove it. Reported results show true positive rates near sixty percent at a one percent false positive rate after attacks. The main limitation is overhead. Full text embedding and ranking increase computation

cost and rely on strong embedding models and protected dictionaries. Other designs shift away from meaning substitution and instead utilizes biased token probabilities with fixed secret sets. Parameter modulation watermarking follows this approach. It embeds a signal by scaling output layer weights for a keyed subset of tokens. A secret key selects a fraction of the vocabulary, often half in experimental settings. These token weights are multiplied by a small factor, usually between 1.05 and 1.1, while all other tokens remain unchanged. This raises the probability of keyed tokens during sampling without retraining. This strategy offers strong statistical detection. The signal accumulates across the sequence, and detection relies on frequency counts and a z score. Values above 2.33 indicate detection at ninety nine percent confidence, with reported scores exceeding six while perplexity stays near baseline. The tradeoff appears under targeted edits. Removing or replacing keyed tokens weakens detection, and heavy paraphrasing lowers reliability. A different direction focuses on dynamic context rather than fixed token sets. SafeSeal (Dang et al., 2026) represents this category. It embeds a keyed signal at each decoding step by hashing the current context and each candidate token using a sixty four bit keyed hash. The hash converts into a score that slightly biases sampling. The relative change in weight stays small, often one to three percent, but accumulates across long outputs. Detection recomputes the hash stream from the final text and evaluates alignment using a likelihood ratio test tuned to a fixed false positive rate. Context based methods perform well on long text. Because of the signal which depends on context, simple word swaps fail to erase it. Overhead stays low and fluency remains stable. The main cost lies in complexity. Generation and detection require synchronized hashing and careful key management. Errors in context reconstruction reduce detection strength. Lastly, attention turns to techniques that use adaptive control instead of direct token insertion. Context aware capacity control watermarking acts as a control layer placed on top of an existing watermark. Each token receives a capacity score derived from nearby generation states. High capacity tokens receive weaker or skipped watermarking, while low capacity tokens receive stronger perturbation. This approach improves quality preservation. To

avoid latency, the system evaluates several parallel continuations with different strengths and selects the best using lightweight attention. Detection relies on the underlying watermark method. The primary drawback is engineering cost. Parallel decoding paths and capacity scoring increase implementation complexity. Taken together, these approaches each have design tradeoffs. Semantic substitution favors meaning stability. Statistical bias favors detection strength, and context based hashing favors robustness across long outputs. Adaptive control favors text quality.

tation or legal consequences without any support or refutation of the claims in existence.

Trustworthiness is the cornerstone of effective LLM watermarking, encompassing explainability, fairness, robustness, security, privacy, accountability, reliability and utility.

In order to overcome the mentioned issues, developing said algorithms with transparency and explainability as a core design principle is essential. Moreover, publishing documentation promoting more algorithmic transparency, such as specifications or benchmarks that entail watermarking logic. Detection algorithms should not be limited to providing binary verdicts, adding confidence scores and/or the parts of the text that contributed most to the result can be highlighted, all together. Furthermore, by documenting methods, limitations, and known failure modes in model cards, further explainability is achieved. Finally, governance standards from regulatory bodies could help establish minimum disclosure requirements and ensure that watermarking systems remain transparent and accountable over time.

5.1

5.2

5

Trustworthiness in Watermarking

Explainability

Explainability in LLM watermarking refers to how clear and interpretable the entire watermarking process - from generation to detection - is for stakeholders such as developers, auditors, researchers and regulators (Zhang and Koushanfar, 2024). The topic revolving around clarifying elements such as how watermark signals are embedded in model outputs, and how detection thresholds are determined (Lalai et al., 2025). Transparency is crucial for monitoring system behavior and trusting watermarking as a tool of control. Moreover, it makes the presence of the watermark open for external evaluation which can assess whether the model output has been affected, e.g. if semantic drift or artifacts have been introduced (Zhang and Koushanfar, 2024). There are many risks revolving around the trustworthiness of watermark when the explainability is not clear. Black boxes or proprietary/closed source watermarking solutions usually fail to allow independent verification and, thus, limit reproducibility. Their opacity weakens the belief in the existence of the watermark or its durability (Yang et al., 2025). Additionally, without proper insight as to how the detection part works, third parties will not be able to reliably tell if a watermark is valid or if the results are influenced by adversarial manipulation or system errors. In situations which are of high stakes, e.g. when an LLM is accused of generating harmful content, the unexplained detections or failures might become the reasons for loss of repu-

Fairness

The core of fairness lies in preventing the watermark’s embedding and detection processes from penalizing specific demographics, languages, or content types (Madiega, 2023; He et al., 2024). A system can not be considered fair if it degrades output quality for particular linguistic styles or if it magnifies the model’s existing biases (Yang et al., 2025). Operational success, therefore, hinges on maintaining consistent error rates and detection accuracy across all domains. When these tools are applied unevenly, the risk of deepening digital divides or sparking new forms of discrimination in economic and legal spheres will increase significantly (Madiega, 2023). Overlooking fairness in watermark development will lead to the risk of ruining the user experience for those speaking minority languages or using non-standard dialects, which leads to immediate exclusion (He et al., 2024). In addition, variable detection thresholds are equally problematic, as they often generate higher false positive rates for specific communities, unfairly subjecting their work to doubt and scrutiny (Liang et al., 2024a; Lalai et al., 2025). On a technical level, secret keys usage can unintentionally target vulnerabilities of specific groups, while probability adjustments might unintentionally lock in stereotypes or discriminatory patterns (Kirchenbauer et al., 2023; Madiega, 2023).

Trustworthiness in LLM Watermarking

Explainability

Fairness

• Clarity for stakeholders (auditors, regulators) • Interpretable embedding & detection thresholds • Transparency for external evaluation

• No systematic disadvantage to demographics/languages • Consistent error rates across domains • Prevents bias amplification

Robustness & Security • Resistance to removal attacks (paraphrasing, editing) • Unforgeability against spoofing • Resilience to adaptive attacks

Reliability & Utility

• Minimal impact on LLM fluency/function • Low risk of false accusation (low FPR) • Feasible operational integration

Figure 2: A conceptual framework illustrating the core pillars of trustworthiness in LLM watermarking: Explainability, Fairness, Robustness (including Security), and Reliability & Utility. These components ensure watermarking serves as an effective tool for attribution without compromising model quality or introducing societal harms.

5.3

Robustness and Security

Robustness with respect to watermarking is the capacity of the watermark signals to be recognized even when the texts have been changed by means of paraphrasing, summarization, translation, or any other kind of transformation (Kirchenbauer et al., 2023; Yang et al., 2025), while security refers to the resistance of watermark schemes to spoofing attack (An et al., 2025). In fact, if a watermark vanishes under typical changes or can be simply eradicated or faked, it is of almost no use for attribution or control purposes. Hence, robustness and security are essential elements if watermarking is to be a source of trustworthy assurances in practical and judicial scenarios (Liang et al., 2024a). Paraphrasing or summarization can drastically lower the detection accuracy, and even neutral edits can reduce performance below feasible levels (Kirchenbauer et al., 2023; Liang et al., 2024a). Simple attack methods, for example, a typing error or character substitution, may also disturb tokenization and degrade watermark integrity without being noticeable by human readers (Liang et al., 2024a). In addition, translation is on the list of adversarial attacks for watermarks, as round trip conversion between languages usually removes the watermark signals (He et al., 2024). More advanced adversaries might also try spoofing, where attackers imitate the watermark’s patterns to incorrectly attribute the source of harmful content to a provider, or use multiple attack strategies simultaneously to overwhelm detection systems (Lalai et al., 2025). Adversarial Attacks on LLM Watermarks In parallel with advances in LLM watermarking, a growing body of work has demonstrated practical

adversarial attacks capable of removing, concealing, or spoofing watermarks with modest effort. Watermark Removal Attacks A primary threat is removal, where adversaries aim to eliminate the watermark signal while preserving semantic fidelity. Common techniques include: • Paraphrasing: LLM-based (e.g., GPT-4, Dipper) or rule-based rephrasing (Liang et al., 2025); • Backtranslation: Round-trip machine translation (e.g., EN→DE→EN); • Lexical edits: Synonym substitution, typo injection, or token swaps; • Linguistic variation: Expansion (adding modifiers/clauses) or contraction (sentence merging); • Text mixing: Interleaving watermarked output with human-generated text to dilute the signal. Empirical benchmarks show that token-level watermarks (e.g., KGW ) drop below 0.4 in true positive rate (TPR) after 40% paraphrasing (DP-40), while distribution-shift methods (RDF (Kuditipudi et al., 2023b), UG (Zhao et al., 2023c)) retain >0.8 TPR (Liang et al., 2025). Watermark Forgery (Spoofing) Forgery occurs when adversaries inject a valid watermark into nonLLM-generated text to falsely attribute provenance or evade accountability. The goal of this type of attack is to undermine the detectors’ credibility. According to a study by (Pang et al., 2024b), there

is a trade-off between increasing the robustness of the watermark and vulnerability against spoofing attacks, showing that there are difficulties in detecting these attacks when several tokens can make the output incorrect. Adaptive Attacks Beyond static edits, adaptive attacks leverage access to the watermarking mechanism. An attacker with black-box API access to the watermarked LLM models can infer approximate rules and then use those to spoof or scrub the watermark (Nikola Jovanovic, 2024). In worse scenarios, when attackers have access to the model’s architecture and weights (white-box scenario), they can disrupt the verification of watermarks without affecting the model’s functionality via neural structural obfuscation (adding "dummy neurons" to network architecture) (Yia et al., 2025). To make the system more robust against different types of adversarial attacks, many solutions are suggested. One of the methods is embedding redundancy where the text is divided into overlapping segments. Hence, watermark embeddings can still be detected after partial edits (Yang et al., 2025). Other solutions include fixed partitioning of token lists to reduce susceptibility to paraphrasing and developing semantic aware watermarks that remain detectable after meaning preserving edits (Kirchenbauer et al., 2023; Lalai et al., 2025). There has also been work on cross lingual grouping of equivalent tokens to make watermarks less vulnerable to translation attacks (He et al., 2024). Beyond algorithm design, the establishment of robustness benchmarks and the public disclosure of detection accuracy and other relevant metrics across different attack scenarios are measures that facilitate reproducibility and transparency (Liang et al., 2024a; Lalai et al., 2025). 5.4

Privacy

LLM watermarking has become one of the crucial ways to mitigate concerns about misinformation, automated spam, academic integrity, and content provenance. However, binary watermarking classification techniques can not keep up with demand from the real-world problems. A solution for the problem is proposed by (Wang et al., 2024) where watermarks are encoded by different red and green lists in each block of text. As a result, multi-bit watermarking is able to not only answer the question "is this text AI-generated?" but also link the generated results to the specific users, sessions or

Figure 3: An overview of MPAC method. The number inside a token (e.g. p = 1 ) denotes the allocated position, while the color signifies the message content at that position. At Step 1, a position is sampled prior to generating a token. Then at Step 2, the message at that position determines the token subsets to favor. Right: Zero-bit watermarking can be viewed as a special case of multi-bit watermarking. (Yoo et al., 2024b)

organizations. However, this method requires developers to consider the payload capacity of the techniques and trade-off between quality and robustness. Payload Capacity of LLM watermarking refers to the amount of information can be embedded into the generated text which is calculated by dividing the number of watermark bits embedded for the number of generated token and measured in bits per token (PBT). For zero-bit or single-bit watermark such as (Kirchenbauer et al., 2023), the amount of information embedded in the whole sequence is one bit which determine whether the text is AIgenerated or not. On the other hand, the capacity of multi-bit watermark such as (Wang et al., 2024) and (Park et al., 2025) ranges from 0.1 to 1.0 PBT. Bit error rate (BER) (Yoo et al., 2023) or bit accuracy (Abdelnabi and Fritz, 2021) are two other metric needed to be considered when developing and evaluating multi-bit watermarking. While BER measures the fraction of bits that are incorrectly decoded, bit accuracy measures the fraction of bits that are correctly decoded. As the capacity of the watermarking technique increase, there will be more information can be embedded into the generated text. In practice, embedded information can be used in text accountability identification process. However, increasing the capacity of the watermark technique can also increase bit error rate (BER) affecting not only the quality of the output but also the accountability tracing process. One of the solution for the trade-off proposed by (Yu et al., 2025) where watermarks are embedded into the output using feature-based rejection sampling. This technique allows the developer to increase the amount of embedded information without making BER index rise.

mentioned issue is utilizing zero-knowledge proofs (ZKP) to verify the correctness of watermark detection without accessing to private keys (Duan et al., 2025). Another possible solution proposed by (Fairoze et al., 2025) where a publicly-verifiable cryptographic signature is embedded into the output using rejection sampling allowing the model to produce unforgeable and distortion-free output. Figure 4: Multi-bit scaling and information density. Watermark accuracy across different message bit lengths at fixed text length. (Yu et al., 2025)

5.5

Accountability

According to (Liu et al., 2025), despite the technical progress of watermarking techniques, rarely these methods are adopted in practice. Beside the competitive risk where users abandon the current service provider to move to the unwatermarked competitors, the issues of detection tools governance, robustness concerns and attribution require consideration on the accountability of LLM watermark. Accountability in LLM watermarking refers to the way watermarking system and its developers justify their design choices, detection outcomes, and operational limitations to affected stakeholders. Since LLM watermarking techniques are inherently probabilistic and operate under explicit threat models and trade-offs between robustness, imperceptibility, and text quality, detection outcomes can not be treated as definitive proof of authorship or intent. Thus, developers have to clearly explain the decision making process, provide statistical guarantees and indicate cases where detection result can be unreliable or misleading. Without explanations, watermarking evidence usage may lead to misattribution, unjust enforcement actions, or misplaced confidence in system outputs. Governance of Detection Tools In order to prevent removal attack, many watermark schemes include the usage of private keys in embedding and detecting watermark. However, the issue of managing and distributing the key still needs careful consideration. While revealing the key or the detection API to the public will introduce adversarial attacks such as spoofing and probing attacks, limited key access to selected third-parties or just the developers only will raise the questions about the fairness, transparency and credibility of the developers (Liu et al., 2025). One of the proposed solutions for the

Robustness Concerns One of the primary concerns when applying watermark techniques into practice is that the robustness of the watermarking techniques is not consistent under various removal attacks (Dang et al., 2025). As developers increase the resistance of watermark schemes in order to deal with removal attacks, they are also risking the chance of sacrificing the output quality. Lack of Users’ Attribution Currently, many watermarking detectors are only able to distinguish whether the text is watermarked or not. However, this binary “AI-generated” labels miss nuanced human contributions as many high quality LLM outputs are the result of not only AI attribution but also a large amount of human’s effort of prompt engineering and post-editing (Liu et al., 2025). (Zhang et al., 2024b) offers a multi-bit watermarking technique which is able to not only protect LLMs’ copyright but also leveraging personal accountability by embedding personalized watermark into sentencelevel structure. 5.6

Reliability and Utility

Reliability and utility capture the extent to which watermarking techniques preserve or minimally impact the effectiveness, fluency, and applicability of LLM outputs across intended practical tasks—such as summarization, question answering, content creation, and information retrieval. While high reliability implies that watermarking methods have minimal possibility of false accusation, high utility refers to the integration of watermark solution into real world deployment pipelines without causing prohibitive computational, operational, or ergonomic overheads. Utility Degradation and Perplexity The main methodology behind many watermarking techniques is to restrict or bias the next-token distribution of the model (e.g., encouraging selection from a “green list” of tokens). This leads to an inevitably increase in the perplexity (PPL) of the output of the model as the watermark becomes more robust.

proach watermark resilience in mixed domain by incorporating both natural language and code generation tasks. Figure 5: Examples generated using LLAMA-2-7B with/without the KGW watermark. Z-score reflects the detection confidence of the watermark, and perplexity (PPL) measures text quality. (Pang et al., 2024c)

False Detection Problem Despite the enormous potential of watermarking techniques, the possibility of false detection still needs careful consideration. According to (Pang et al., 2024c), increasing the number of keys will contribute to a better defense against watermark stealing attacks. However, the model will become more vulnerable to watermark removal attacks. Resulting in the increase of the false negative rate. (e.g., although the attack success rate (ASR) of watermark stealing attacks decreases to nearly zero when the number of keys increase to 7, watermark removal attacks have the ASR up to 97%). In addition, since each watermark key induces a particular subset or bias in the token distribution of the model’s output, the union of all biased distribution will approach the full natural token distribution as more keys are being used. Consequently, some non-watermarked texts will inadvertently align with one of the key-patterns, resulting in the increase of false positive rate in multi-use watermarking (Zihao Fu, 2025). Reliability in Downstream Tasks Recent studies have shown that watermark methods have affected not only the quality of LLM output in general but also the performance of LLMs on downstream task. In a report by (Shangqing et al., 2024), when evaluating the performance of watermarked LLM on open-ended task, the experiment shows that the quality score of the output dropped by more than 96%, compared to the original output. In addition, in the research by (Hastuti et al., 2025), researchers show that there is an increase in the hallucination rate of the watermarked LLM. Thus, LLM watermarking evaluation can not stop at evaluating generation and detection. New evaluation criteria are needed for researchers to have better understanding when comparing different watermarking methods. One of the solutions proposed by (Shangqing et al., 2024) is to unify the strength across watermarking methods and evaluate the performance through analyzing the impacts across 9 different NLP tasks. While (Piet et al., 2025) ap-

Workflow Disruption and Poor Integration LLM watermarking is relatively new field and currently developing at a significant pace with many new methods are developed over year. However, the abundance of LLM watermarking techniques with different approaches and complex mechanisms creates significant challenges for researchers and community to understand and align with established deployment, monitoring, or legal workflow which impedes practical adoption and broader utility. There has been attempt to address this issue. (Pan et al., 2024) has developed an unified and extensible framework for implementing watermarking while also supporting comprehensive suite of tools for evaluation.

6

Conclusion

LLM watermarking is a promising tool for provenance, attribution, and auditing, but the literature remains difficult to compare due to mixed assumptions, unclear detection authority, and inconsistent threat models. This survey organizes methods around deployment-critical questions—where the signal is embedded, who can detect it, what access/secrets are required, and which adversaries must be resisted—clarifying why similar-looking approaches can yield very different guarantees. Overall, watermarking is a systems trade-off: stronger detectability and robustness typically demand greater control (over decoding or training) and may introduce distribution shift, while lowperturbation designs better preserve quality but often weaken robustness under paraphrasing, translation, or adaptive attacks. Future progress requires standardized benchmarks and reporting (especially calibration and false-positive control), stronger evaluation against adaptive removal and crossmodel transfer, and designs that remain reliable in multi-stage, tool-using and multi-modal pipelines. With these advances, invisible signatures can become a practical layer in trustworthy AI governance.

References Sahar Abdelnabi and Mario Fritz. 2021. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 2021 IEEE Symposium on Security and Privacy (SP), pages 121–140. IEEE. Li An, Yujian Liu, Yepeng Liu, Yuheng Bu, Yang Zhang, and Shiyu Chang. 2025. A reinforcement learning framework for robust and secure llm watermarking. arXiv preprint arXiv:2510.21053. Rohan Anil and 1 others. 2023. Palm 2 technical report. Google Research. Anthropic. 2024. Claude. https://www.anthropic. com/claude [Accessed: 2024-09-20]. Azure. 2021. https://aka.ms/ AzureMLModelInterpretability. Emily M. Bender, Timnit Gebru, Angelina McMillanMajor, and Sherri Mitchell. 2021. On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, pages 610–623. Su Lin Blodgett, Solon Barocas, Hal Daumé III, and Hanna Wallach. 2020. Language (technology) is power: A critical survey of “bias” in nlp. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. Bluemix. 2021. Ai explainability 360. Available at https://aix360.mybluemix.net/. Tolga Bolukbasi, Kai-Wei Chang, James Zou, Venkatesh Saligrama, and Adam Kalai. 2016. Man is to computer programmer as woman is to homemaker? debiasing word embeddings. In Advances in Neural Information Processing Systems. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877–1901. Nicholas Carlini, Matthew Jagielski, Florian Tramer, Shuang Song, Ulfar Erlingsson, and Nicolas Papernot. 2022. Quantifying memorization across neural language models. arXiv preprint arXiv:2202.07646. Nicholas Carlini, Daniel Paleka, Krishnamurthy (Dj) Dvijotham, Thomas Steinke, Jonathan Hayase, A. Feder Cooper, Katherine Lee, and 1 others. 2024. Stealing part of a production language model. In ICML. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Song, and Ulfar Erlingsson. 2021. Extracting training data from large language models. In USENIX Security Symposium.

Yapei Chang, Kalpesh Krishna, Amir Houmansadr, John Frederick Wieting, and Mohit Iyyer. 2024. PostMark: A robust blackbox watermark for large language models. In EMNLP. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, and 1 others. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374. Miranda Christ, Sam Gunn, and Or Zamir. 2024. Undetectable watermarks for language models. In COLT, pages 1125–1139. Cohere. 2024. Cohere. https://cohere.com/ [Accessed: 2024-09-20]. Chetan Conikee. 2024. An ai attack that even sherlock holmes would be impressed by... https://qwiet.ai/anai-attack-that-would-impress-even-sherlockholmes/. Kieu Dang, Phung Lai, NhatHai Phan, Yelong Shen, and Ruoming Jin. 2026. Robust llm watermarking with minimal semantic distortion for ip protection. Preprint, arXiv:2605.23175. Kieu Dang, Phung Lai, NhatHai Phan, Yelong Shen, Ruoming Jin, Abdallah Khreishah, and My T. Thai. 2025. Sok: Are watermarks in llms ready for deployment? Preprint, arXiv:2506.05594. Sumanth Dathathri, Abigail See, Sumedh Ghaisas, PoSen Huang, and 1 others. 2024. Scalable watermarking for identifying large language model outputs. Nature, 634. Jacob Devlin and 1 others. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. NAACL-HLT. Haohua Duan, Liyao Xiang, and Xin Zhang. 2025. Pvmark: Enabling public verifiability for llm watermarking schemes. arXiv preprint arXiv:2510.26274. Jaiden Fairoze, Sanjam Garg, Somesh Jha, and 1 others. 2025. Publicly-detectable watermarking for language models. IACR Communications in Cryptology, 1(4). Deep Ganguli, Amanda Askell, Nicholas Schiefer, Thomas Liao, and 1 others. 2022. Red teaming language models to reduce harms. arXiv preprint arXiv:2209.07858. Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. 2020. Realtoxicityprompts: Evaluating neural toxic degeneration in language models. In Findings of the Association for Computational Linguistics: EMNLP 2020. Sebastian Gehrmann, Hendrik Strobelt, and Alexander M. Rush. 2019. Gltr: Statistical detection and visualization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics.

Eva Giboulot and Furon Teddy. 2024. Watermax: breaking the llm watermark detectability-robustnessquality trade-off. In NeurIPS. Josh Goldstein, Girish Sastry, Matt Musser, and 1 others. 2023. Generative language models and automated influence operations. arXiv preprint arXiv:2301.07127. Noah Golowich and Ankur Moitra. 2024. Edit distance robust watermarks for language models. In NeurIPS.

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning, pages 17061–17084. PMLR. Kalpesh Krishna, Yixiao Song, and 1 others. 2024. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. NeurIPS, 36.

gemini.

Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023a. Robust distortion-free watermarks for language models. TMLR.

Rochana Prih Hastuti, Rian Adam Rajagede, Mansour Al Ghanim, Mengxin Zheng, and Qian Lou. 2025. Factuality beyond coherence: Evaluating llm watermarking methods for medical texts. arXiv preprint arXiv:2509.07755.

Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023b. Robust distortion-free watermarks for language models. arXiv preprint arXiv: 2307.15593.

Google. 2024. Google https://bard.google.com/chat/.

Xiaojun He, Qiang Xu, Lingjuan Lyu, Fei Wu, and Cong Wang. 2022. Protecting intellectual property of language generation apis with lexical watermark. In Proceedings of the AAAI Conference on Artificial Intelligence. Zhiwei He, Binglin Zhou, Hongkun Hao, Aiwei Liu, Xing Wang, Zhaopeng Tu, Zhuosheng Zhang, and Rui Wang. 2024. Can watermarks survive translation? on the cross-lingual consistency of text watermark for large language models. arXiv preprint arXiv:2402.14007. A. B. Hou, Jingwei Zhang, Tianxing He, Yiming Wang, and 1 others. 2024a. Semstamp: A semantic watermark with paraphrastic robustness for text generation. In Proceedings of the North American Chapter of the Association for Computational Linguistics (NAACL). B. Hou, Jingwei Zhang, and 1 others. 2024b. ksemstamp: A clustering-based semantic watermark for detection of machine-generated text. In Findings of the Association for Computational Linguistics (ACL). Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2023. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669. Zhenyu Hu, Linyi Chen, Xiaojun Wu, Yuxin Wu, Hao Zhang, and Heng Huang. 2024. Unbiased watermark for large language models. In International Conference on Learning Representations (ICLR). Ziwei Ji, Nanyun Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yanfei Xu, Eric Ishii, Yejin Bang, Andrea Madotto, and Pascale Fung. 2023. Survey of hallucination in natural language generation. ACM Computing Surveys. Enkelejda Kasneci and 1 others. 2023. Chatgpt for good? on opportunities and challenges of large language models for education. Learning and Individual Differences.

Harsh Nishant Lalai, Aashish Anantha Ramakrishnan, Raj Sanjay Shah, and Dongwon Lee. 2025. From intentions to techniques: A comprehensive taxonomy and challenges in text watermarking for large language models. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 6147–6160, Albuquerque, New Mexico. Association for Computational Linguistics. Harsh Nishant Lalai, Aashish Anantha Ramakrishnan, Raj Sanjay Shah, and Dongwon Lee. 2024. From intentions to techniques: A comprehensive taxonomy and challenges in text watermarking for large language models. arXiv preprint arXiv:2406.11106. Katherine Lee, Nikhil Kandpal, Gaurav Mahajan, Saurabh Arora, and Florian Tramer. 2022. Deduplicating training data mitigates privacy risks in language models. In Proceedings of the 39th International Conference on Machine Learning. Zongjie Li and 1 others. 2023. Protecting intellectual property of large language model-based code generation apis via watermarks. In ACM SIGSAC, pages 2336–2350. Jiacheng Liang, Zian Wang, Lauren Hong, Shouling Ji, and Ting Wang. 2024a. Waterpark: A robustness assessment of language model watermarking. arXiv preprint arXiv:2411.13425. Jiacheng Liang, Zian Wang, Spencer Hong, Shouling Ji, and Ting Wang. 2025. Watermarkunderfire: A robustness evaluation of llm watermarking. arXiv preprint arXiv: 2411.13425. Yuqing Liang, Jiancheng Xiao, Wensheng Gan, and Philip S Yu. 2024b. Watermarking techniques for large language models: A survey. arXiv preprint arXiv:2409.00089. Stephanie Lin, Jacob Hilton, and Owain Evans. 2021. Truthfulqa: Measuring how models mimic human falsehoods. arXiv preprint arXiv:2109.07958.

Aiwei Liu, Leyi Pan, Xuming Hu, Shuang Li, Lijie Wen, Irwin King, and S Yu Philip. 2023. An unforgeable publicly verifiable watermark for large language models. In ICLR.

Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. 2024c. No free lunch in llmwatermarking: Trade-offs in watermarking design choices. arXiv preprint arXiv: 2402.16187.

Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2024a. A semantic invariant robust watermark for large language models. ICLR.

Shinwoo Park, Hyejin Park, Hyeseon Ahn, and Yo-Sub Han. 2025. Watermod: Modular token-rank partitioning for probability-balanced llm watermarking. arXiv preprint arXiv:2511.07863.

Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. 2024b. A survey of text watermarking in the era of large language models. ACM Computing Surveys. Aohan Liu, Liangming Pan, Xiaojun Hu, Shiqi Meng, and Lin Wen. 2024c. A semantic invariant robust watermark for large language models. In International Conference on Learning Representations (ICLR). Yepeng Liu and Yuheng Bu. 2024. Adaptive text watermark for large language models. In ICML. Yepeng Liu, Xuandong Zhao, Dawn Song, Gregory W Wornell, and Yuheng Bu. 2025. Position: Llm watermarking should align stakeholders’ incentives for practical adoption. arXiv preprint arXiv:2510.18333. Tambiama Madiega. 2023. Generative ai and watermarking. Briefing pe 757.583, European Parliamentary Research Service. T. Munyer and 1 others. 2024. Deeptextmark: A deep learning-driven text watermarking approach for identifying llm-generated text. IEEE Access. Martin Vechev Nikola Jovanovic, Robin Staab. 2024. Watermark stealing in large language models. arXiv preprint arXiv: 2402.19361. OpenAI. 2024. https://openai.com/index/ openai-api/ [Accessed: 2024-09-20]. OpenAI. 2024. Gpt-4 technical report. Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, and 1 others. 2024. Markllm: An open-source toolkit for llm watermarking. In EMNLP, pages 61–71. Kai Pang, Tianhao Qi, Chao Wu, Min Bai, Ming Jiang, and Yi Huang. 2025. Modelshield: Adaptive and robust watermark against model extraction attack. IEEE Transactions on Information Forensics and Security. Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. 2024a. Attacking llm watermarks by exploiting their strengths. arXiv preprint arXiv:2402.16187. Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. 2024b. Attacking llm watermarks by exploiting their strengths. arXiv preprint arXiv: 2402.16187v1.

Julien Piet, Chawin Sitawarin, Vivian Fang, Norman Mu, and David Wagner. 2025. Markmywords: Analyzing and evaluating language model watermarks. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 68–91. IEEE. Xinjie Ren and 1 others. 2024. Semamark: A semanticsbased watermark robust to paraphrasing. In Findings of the Association for Computational Linguistics: NAACL 2024. Venkatesh Sadasivan, Yixin Wang, Eric Ruan, and 1 others. 2023. Can watermarks survive translation? on the robustness of watermarking for generative models. arXiv preprint arXiv:2306.04634. Tu Shangqing, Yuliang Sun, Yushi Bai, Jifan Yu, Lei Hou, and Juanzi Li. 2024. Waterbench: Towards holistic evaluation of watermarks for large language models. arXiv preprint arXiv:2311.07138. Sheng Shen and 1 others. 2023. On the (im)possibility of detecting ai-generated text. arXiv preprint arXiv:2307.13528. Congzheng Song and Vitaly Shmatikov. 2019. Auditing data provenance in text-generation models. In Proceedings of the 2019 IEEE Symposium on Security and Privacy. A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems. Jon Victor and Amir Efrati. 2023. Alphabets google and deepmind pause grudges, join forces to chase openai. https://www.theinformation.com/articles/alphabetsgoogle-and-deepmind-pause-grudges-join-forcesto-chase-openai. Eric Wallace, Mitchell Stern, and Dawn Song. 2020. Imitation attacks and defenses for black-box machine translation systems. EMNLP. Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. 2024. Towards codable text watermarking for large language models. ICLR. Laura Weidinger, John Mellor, Maribeth Rauh, Jamie Griffin, Jonathan Uesato, Po-Sen Huang, and 1 others. 2021. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359. Lingyun Xiang and 1 others. 2024. A reversible natural language watermarking for sensitive information protection. Information Processing & Management.

Haoran Xu, Young Jin Kim, Amr Sharaf, and Hany Hassan Awadalla. 2024. A paradigm shift in machine translation: Boosting translation performance of large language models. ICLR.

Hanlin Zhang, Benjamin L Edelman, Danilo Francati, and 1 others. 2024a. Watermarks in the sand: Impossibility of strong watermarking for generative models. In ICML.

Qiongkai Xu, Xuanli He, Lingjuan Lyu, Lizhen Qu, and Gholamreza Haffari. 2022. Student surpasses teacher: Imitation attack for black-box nlp apis. COLING.

Ruisi Zhang and Farinaz Koushanfar. 2024. Watermarking large language models and the generated content: Opportunities and challenges. In 2024 58th Asilomar Conference on Signals, Systems, and Computers, pages 1779–1786. IEEE.

Mingfu Xue, Zhiyu Wu, Yushu Zhang, Jian Wang, and Weiqiang Liu. 2022. Advparams: An active dnn intellectual property protection technique via adversarial perturbation based parameter encryption. IEEE Transactions on Emerging Topics in Computing, 11(3):664–678.

Xinyu Zhang, Benjamin Edelman, Matteo Francati, Andrea Venturi, Giuseppe Ateniese, and Boaz Barak. 2023b. Watermarks in the sand: Impossibility of strong watermarking for generative models. arXiv preprint arXiv:2311.04378.

Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma, and 1 others. 2022. Tracing text provenance via context-aware lexical substitution. In AAAI, pages 11613–11621.

Xuan Zhang, Navid Rajabi, Kevin Duh, and Philipp Koehn. 2023c. Machine translation with large language models: Prompting, few-shot learning, and fine-tuning with qlora. In Proceedings of the Eighth Conference on Machine Translation, pages 468–481.

Zhiguang Yang, Gejian Zhao, and Hanzhou Wu. 2025. Watermarking for large language models: A survey. Mathematics, 13(9):1420. Xin Yia, Yue Li, Shunfan Zheng, Linlin Wang, Xiaoling Wang, and Liang He. 2025. Unified attacks to large language model watermarks: spoofing and scrubbing in unauthorized knowledge distillation. arXiv preprint arXiv: 2504.17480. KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. 2023. Robust multi-bit natural language watermarking through invariant features. arXiv preprint arXiv:2305.01904. KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. 2024a. Advancing beyond identification: Multi-bit watermark for language models. NAACL. KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. 2024b. Advancing beyond identification: Multi-bit watermark for large language models. In NAACL. Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, and 1 others. 2021. Differentially private fine-tuning of language models. arXiv preprint arXiv:2110.06500. Zhuohao Yu, Xingru Jiang, Weizheng Gu, Yidong Wang, Shikun Zhang, and Wei Ye. 2025. Saemark: Multibit llm watermarking with inference-time scaling. arXiv preprint arXiv:2508.08211. Rowan Zellers and 1 others. 2019. Defending against neural fake news. NeurIPS. Biao Zhang, Barry Haddow, and Alexandra Birch. 2023a. Prompting large language model for machine translation: A case study. In ICML, pages 41092– 41110.

Yuehan Zhang, Peizhuo Lv, Yinpeng Liu, Yongqiang Ma, Wei Lu, Xiaofeng Wang, Xiaozhong Liu, and Jiawei Liu. 2024b. Personamark: Personalized llm watermarking for model protection and user attribution. arXiv preprint arXiv:2409.09739. Xinyan Zhao, Prashanth V. Ananth, Lei Li, and Yuxin Wang. 2024. Provable robust watermarking for aigenerated text. In International Conference on Learning Representations (ICLR). Xinyan Zhao, Yuxin Wang, and Lei Li. 2023a. Protecting language generation models via invisible watermarking. In Proceedings of the International Conference on Machine Learning (ICML). Xinyan Zhao, Yuxin Wang, and Lei Li. 2023b. Watermax: Selecting text with maximum watermark strength for robust detection of machine-generated text. arXiv preprint arXiv:2310.XXXX. Xuandong Zhao, Prabhanjan Ananth, Lei Li, and YuXiang Wang. 2023c. Provable robust watermarking for ai-generated text. arXiv preprint arXiv: 2306.17439. Xuandong Zhao, Yu-Xiang Wang, and Lei Li. 2023d. Protecting language generation models via invisible watermarking. In ICML, pages 42187–42199. PMLR. Chris Russell Zihao Fu. 2025. Multi-use llm watermarking and the false detection problem. arXiv preprint arXiv: 2506.15975.