# LLM Watermarking

LLM watermarks must keep output diversity under a fixed key and must not lower draft acceptance under speculative decoding, and the two have been hard to hold together. TextSeal2 merges two keys' Gaussian values into one virtual key and couples it to fresh noise through a Gaussian copula, so the detector reads full signal on every token; under speculative decoding it decides each round's last token with one more exponential race on the leftovers of the draft races. At equal diversity on three models it detects 8 to 22 percentage points more 100-token answers than TextSeal, and under speculative decoding 18 and 22 points more 200-token answers than TextSeal and textGrain, at unchanged acceptance.

LLM watermarks must keep output diversity under a fixed key and must not lower draft acceptance under speculative decoding, and the two have been hard to hold together. TextSeal2 merges two keys' Gaussian values into one virtual key and couples it to fresh noise through a Gaussian copula, so the detector reads full signal on every token; under speculative decoding it decides each round's last token with one more exponential race on the leftovers of the draft races. At equal diversity on three models it detects 8 to 22 percentage points more 100-token answers than TextSeal, and under speculative decoding 18 and 22 points more 200-token answers than TextSeal and textGrain, at unchanged acceptance.

In federated LLM fine-tuning, a server using the strong Byzantine-robust aggregator RandEigen filters out existing text-watermark updates as outliers, but optimizing the watermarked samples' input embeddings to sit close to clean updates keeps the watermark detectable by black-box access from a single client's 3.3% effective watermarked data.

In federated LLM fine-tuning, a server using the strong Byzantine-robust aggregator RandEigen filters out existing text-watermark updates as outliers, but optimizing the watermarked samples' input embeddings to sit close to clean updates keeps the watermark detectable by black-box access from a single client's 3.3% effective watermarked data.

Detecting a watermark in large-model text used to require the generating side's tokenizer or semantic embedding pipeline, which the text itself does not reveal, so text of unknown origin was hard to verify. ByteMark defines its signal on the UTF-8 byte stream of the published text; participating models embed it under one public specification and key, and a verifier needs only the text and the key. In experiments, replacing the detector's tokenizer or embedding model sharply degraded token-level and sentence-level baselines, while ByteMark's detection rate was unchanged, and it stayed detectable through a relay of models and after participating rewriters re-embedded the watermark.

Detecting a watermark in large-model text used to require the generating side's tokenizer or semantic embedding pipeline, which the text itself does not reveal, so text of unknown origin was hard to verify. ByteMark defines its signal on the UTF-8 byte stream of the published text; participating models embed it under one public specification and key, and a verifier needs only the text and the key. In experiments, replacing the detector's tokenizer or embedding model sharply degraded token-level and sentence-level baselines, while ByteMark's detection rate was unchanged, and it stayed detectable through a relay of models and after participating rewriters re-embedded the watermark.

The authors revisit a watermark-distillation protocol for LLM fingerprinting, show that its utility evaluation understates text-quality degradation in open-ended generation, and propose near-tie restriction, which uses top-1-relative logit gaps to confine the watermark bias to tokens close to the base model's top prediction; across Llama-3.2-3B, Qwen-2.5-3B, Llama-3.1-8B, and Gemma-9B, this improves detection-quality frontiers under sampling, system prompts, quantization, pruning, and fine-tuning, preserves higher text quality across query budgets, and further improves existing schemes when combined with them.

The authors revisit a watermark-distillation protocol for LLM fingerprinting, show that its utility evaluation understates text-quality degradation in open-ended generation, and propose near-tie restriction, which uses top-1-relative logit gaps to confine the watermark bias to tokens close to the base model's top prediction; across Llama-3.2-3B, Qwen-2.5-3B, Llama-3.1-8B, and Gemma-9B, this improves detection-quality frontiers under sampling, system prompts, quantization, pruning, and fine-tuning, preserves higher text quality across query budgets, and further improves existing schemes when combined with them.

The authors propose SWIFT, a framework that asynchronously co-serves text generation and watermark construction on the same vLLM backend, LLM, and GPU: it uses instruction-guided candidate generation with entity protection to produce context-aware substitutions, embeds watermarks via key-conditioned Tournament selection, and adapts watermark request admission with a scheduler driven by queue length and waiting-time pressure; on C4 text generation it attains the highest utility score of 4.87, 99.65% detection accuracy, and 0.905 s latency, retains 97.7% detection under substitution attacks, preserves task accuracy on GSM8K and MedMCQA, and reaches 528.7 tokens/s throughput with a 96.8% prefix-cache hit rate.

The authors propose SWIFT, a framework that asynchronously co-serves text generation and watermark construction on the same vLLM backend, LLM, and GPU: it uses instruction-guided candidate generation with entity protection to produce context-aware substitutions, embeds watermarks via key-conditioned Tournament selection, and adapts watermark request admission with a scheduler driven by queue length and waiting-time pressure; on C4 text generation it attains the highest utility score of 4.87, 99.65% detection accuracy, and 0.905 s latency, retains 97.7% detection under substitution attacks, preserves task accuracy on GSM8K and MedMCQA, and reaches 528.7 tokens/s throughput with a 96.8% prefix-cache hit rate.