Distilling the Thought, Watermarking the Answer: A Principle Semantic Guided Watermark for Reasoning Large Language Models
Authors: Shuliang Liu
Xingyu Li
Hongyi Liu
Dong Fang
Duan Bingchen
Zheng Qi
Lingfeng Su
Xuming Hu
Venue: ICLR 2026 Poster (2026)
Keywords: Reasoning Large Language Model
Watermark
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Reasoning Large Language Models (RLLMs) excelling in complex tasks present unique challenges for digital watermarking, as existing methods often disrupt logical coherence or incur high computational costs. Token-based watermarking techniques  can corrupt the reasoning flow by applying pseudo-random biases, while semantic-aware approaches improve quality but introduce significant latency or require auxiliary models. This paper introduces ReasonMark, a novel watermarking framework specifically designed for reasoning-intensive LLMs. Our approach decouples generation into an undisturbed Thinking Phase and a watermarked Answering Phase. We propose a Criticality Score to identify semantically pivotal tokens from the reasoning trace, which are distilled into a Principal Semantic Vector (PSV). The PSV then guides a semantically-adaptive mechanism that modulates watermark strength based on token-PSV alignment, ensuring robustness without compromising logical integrity. Extensive experiments show ReasonMark surpasses state-of-the-art methods by reducing text Perplexity by 0.35, increasing translation BLEU score by 0.164, and raising mathematical accuracy by 0.67 points. These advancements are achieved alongside a 0.34% higher watermark detection AUC and stronger robustness to attacks, all with a negligible increase in latency. This work enables the traceable and trustworthy deployment of reasoning LLMs in real-world applications.

Published as a conference paper at ICLR 2026
DISTILLING THE THOUGHT, WATERMARKING THE AN- SWER: A PRINCIPLE SEMANTIC GUIDED WATERMARK FOR LARGE REASONING MODELS
Shuliang Liu Xingyu Li', Hongyi Liu', Dong Fang",
Bingchen Duan 12, Qi Zheng!. Lingfeng Su², Xuming Hul
The Hong Kong University of Science and Technology (Guangzhou)
2 The Hong Kong University of Science and Technology
LLGHHTSPEED
shu 1 Laiiiiingyy@@@miii11 com
d 12t2outtooooee
2115639257014gma... com www. www.ngghubhusstt-e0 .du.eduuccmmm on
ABSTRACT
Reasoning Large Language Models (RLLMs) excelling in complex tasks present unique challenges for digital watermarking, existing methods often disrupt logical coherence or incur high computational costs. Token-based watermarking techniques corrupt the reasoning flow by applying pseudo-random biases, while semantic-aware approaches improve quality but introduce significant latency or require auxiliary models. This paper introduces ReasonMark, novel watermark- ing framework specifically designed for crasoning-intensii LLMs. Our approach decouples generation into undisturbed Thinking Phase and watermarked An- swering Phase. We propose a Criticality Score to identify semantically pivotal tokens from the reasoning trace, which are distilled into a Principal Semantic Vector (PSV). The PSV then guides semantically-adattiv mechanism that mod- ulates watermark strength based on token-PSV alignment, ensuring robustness without compromising logical integrity. Extensive experiments show ReasonMark surpasses state-of- state-of-the-ase the-art methods by reducing text Perplexity by 0.35, increasing translation BLEU score by 0.164, and raising mathematical accuracy by 0.67 points. These advancements are achieved alongside a 0.34% higher watermark detection AUC and stronger robustness attacks, all with a negligible increase in latency. This work enables the traceable and trustworthy deployment of reasoning LLMs in real-world applications. The source code available here
INTRODUCTION
Large Language Models (LLMs) have demonstrated remarkable advancements in recent years, achieving state-of-the-art performance across multitude of domains including information retrieval (Labruna et al.] 2024| Jin et al., 2025 Hu et al. 2022 Zhang et al.] 2025a), medical diagnosis (Zhou al. 2024), financial ysis (Li et al. 2023b] Lopez-Lira al. (2025). legal assistance
(Kuk & Harasta 2025 Fei et al. h023). academic research (Liao et al.) [2024] Naveed et al. 2023). and speech processing (Hei et al. (0255.. More recently, new wave of models, exemplified by
systems like ChatGPT-44 (Jacch et al. (024) and DeepSeek- V2 (Guo et al., (2025), have showcased superior capabilities in complex reasoning tasks such as mathematical problem-solving strategic planning, code generation, and scientific discovery (Guo et al. 2025 Wei et al. 2025 Wen et al.)
2025 Liu et al. 2026 Ling et al. 2025b). These ceasoning-intensii LLMs often employ distinct training paradigms and inference mechanisms, such as internal monologues or chain-of of-thought (CoT) prompting (Wei et al. 2022), which differentiate them significantly from their predecessors.
The burgeoning capabilities and widespread adoption of LLMs, particularly those adept at reasoning, necessitate robust mechanisms for ensuring content authenticity, traceability, and intellectual property protection. Digital watermarking (Kirchenbauer al. 2023 has emerged promising technique
Coorreponning authors: Dong Fang and Xuming Hu.

---

Published as a conference paper at ICLR 2026
to invisibly embed identifiable signals within model-generated text. thereby enabling source tracking and mitigating misuse (Abdelnabi & Fritz] /02nn/Chang et al. 2024; Hou et al. 2023). However, existing watermarking algorithms, largely developed for general-purpose LLMs, face significant challenges when applied to reasoning- -hased models. For instance, methods like KGW (Kirchenhauer et al. 2023), which rely pseudo-random vocabulary partitioning, can inadvertently disrupt the logical consistency of the model's 's internal reasoning- thinking phase-thereby compromising the coherence and accuracy of the final answer. Other approaches that focus on preserving text quality, such as unbiased sampling techniques (Hu et al. 2023), often do so at the cost of detection efficiency. Conversely, methods like EWD (Lu et al. al.] 2024) and SWEET (Lee al. 2023), while achieving higher detection rates, may introduce perceptible artifacts that degrade text quality. More sophisticated strategies like WaterMax (Giboulot & Furon] 2024), which perform multiple generation runs to find optimally watermarked outputs, achieve a better balance but incur substantial computational overhead and increased inference latency. This persistent trade-off among text quality, watermark detectability, and computational efficiency has hindered the practical deployment of watermarking in many real-world applications (Liu et al. 2024 Huang et al. 2025).
To address these challenges, we introduce ReasonMark, novel watermarking framework specifically designed for large reasoning models, centered on the principle of Distilling the Thought. Watermarking the Answer, illustrated in Fig. [ Our approach decouples the generation process into two distinct stages: an undisturbed internal Thinking Phase, where the model performs its reasoning, and a subsequent Answering Phase, where the final response is generated. The core innovation lies in preserving the integrity of the thinking phase entirely. We analyze it to identify a set of Criticality Tokens (CTs) that encapsulate the most salient semantic anchors of the reasoning process. These tokens are then distilled into a continuous vector representation, the Principal Semantic Vector (PSV), which serves as a dynamic semantic compass for the answering phase. The PSV guides a cataanicalll-adaptiin watermarking mechanism, where the watermark strength applied to candidate tokens modulated by their alignment with the model's established reasoning trajectory. By aligning the watermark with the model's ' own logical flow, ReasonMark can embed a robust and detectable signal without disrupting coherence or accuracy. This effectively resolves the debilitating trade-off between watermark strength and semantic integrity, all while avoiding the additional inference latency common in other semantic-aware techniques. Our main contributions are threefold:
We propose a novel two-phase watermarking framework that decouples a model's 's internal reasoning from its final answer generation. This is the first approach specifically designed to protect the outputs of RLLMs without corrupting their logical integrity.
We design a principled method to distill the semantic essence of the model's 's reasoning pro- cess, involving Criticality Score to identify key tokens and their subsequent transformation into a PSV that provides a continuous, directional guide for watermarking.
Extensive experiments show ReasonMark surpasses baselines by reducing text PPL by 0.35, increasing translation BLEU score by 0.164, and raising mathematical accuracy by 0.67 points, while also improving detection AUC by 0.34% with negligible latency.
2 PRELIMINARY
In this section, we introduce loken-based and semantic- baaset watermarking methods, outlining their respective strengths and limitations. We then formalize the framework of our proposed algorithm and define its key concepts.
Related Work. Existing LLM watermarking research primarily divided into noken-based and semantic- based approaches. Token-based methods, such as the seminal work by Kirchenbauer et al. (2023), partition the vocabulary and apply a statistical bias during generation (Hu et al. (023). While effective for detection, their pseudo-random nature can disrupt the logical flow and semantic consistency crucial for reasoning tasks (Yoo et al. 2024| Chang et al. 22024). Adaptive watermark strength methods like (Wang et al. 2025b) balance the effectiivnnes--ualiyy trade-off at the list level but ignore the intra-list importance of individual tokens. Conversely, semantic-based methods operate in the embedding space to improve text quality and robustness against paraphrasing (Ren al. 2023) Hou et al. [2023] Huo et al., 2025). However, they often introduce sigmificant computational overhead by requiring auxiliary models architectural modifications (Baldassini et al. 2024), and
2

---

Published as a conference paper at ICLR 2026
1. Input
II. Thinking Phase
III. PSV
IV. Watermark
V. Answering Phase
Traditorol
Token based
PCA &
Prompt
sampling
X
Semarnec besed
(S(+) = (CC(M) + Ing(1 (P)()))
X
Tap- K Tokens
Re-1
RELM
Stezegth basol oz R:
.%
<ahenie>
Telees
Dlingeive
Coleenn
Cualed by Scrunas Disciion
Coloree Cooe
Rad Tokuna
Indieledd ICAA
Figure I: ReasonMark identifies top-K critical tokens during the thinking phase (II.) and uses PCA (III.) to establish an initial Principal Semantic Vector (PSV). This semantic vector then guides the watermarking process (IV.) by dynamically adjusting the logits to favor semantically coherent green tokens and penalize disruptive ones. enables the efficient generation of a semantically coherent watermarked sequence with high proportion of green tokens (V.) by sampling only one time.
not specifically tailored to preserve the step-by-step integrity of complex reasoning (Dagupta cet al. 2024). Our PSV-guided watermarking framework bridges this gap by distilling the reasoning phase into continuous Principal Semantic Vector, which dynamically modulates watermark strength based on DoVen-PSV aligument. This approach ensures the watermark is semantically coherent, thus preserving logical integrity, key weakness of token-based methods, while maintaining high detection efficiency and avoiding the extra inference costs typical of many semantic-aware techniques (Baldassini et al. 2024). A more comprehensive review of related work is available in Appendix [B]
Phase Segmentation. Let T = {11, 12,,..,,.,, ts}} denote the full sequence of 5 tokens generated by language model. We partition 7' into two distinct phases. The Thinking Phase: Think = { {f1, (2..,.... |N
comprising the model's internal chain-of-thought or reasoning steps. The Answering {++}+ fIN+1, .... }.}, representing the final response intended for the user.
Phase: T answer
The delineation point k is identified via a Marker- Based Separation Algorithm (Guo et al. 2025) that
detects structural delimiters (e.g., <think>, <Athink>), as illustrated in [I
Definition 2.1 (Semantic Guidance via Principal Semantic Vector). Given the thinking phase Tainkk
the sequence of probability distributions over the vocabulary V during thinking phase (P.) and the previously generated answer tokens (tN+1:...,tt) tt), we define:
Ro = [n(44) (P)) 6i,4, = -go (R,,,,1), R, = (R
Here, the initial PSV Ro captures the reasoning trajectory, while 6,,t, provides watermark guidance to token t; at step i. The PSV R. updates dynamically to reflect the evolving semantic context, ensuring watermark strength aligns with the model's logical flow throughout answer generation. The design of fa (Fig. II. to III.) poses the primary challenge: thus, the rest of this section details its design, while the implementations of go (Fig. IV.) and fa (Fig. III. are deferred to Section 3.2
Principle Semantic Vector Construction. The foundation for constructing PSV rests upon identi- fying a curated set of Critical Tokens (CTs) within the thinking phase Titikk inspired by (Liu et al.) 2025b Zheng et al. 2026). These CTs are hypothesized to encapsulate the most salient semantic anchors of the reasoning process and thus provide the essential raw material for deriving the initial PSV. We then formalize the notion that token's 's criticality is a function of both its influence the generative trajectory and its ability to resolve uncertainty. This principle is encapsulated in the following theorem, which defines an optimal set of CTs.
Theorem 2.2 (Optimal Representation of Critical Tokens). The optimal set of Critical Tokens, denoted C C V, is the set that maximizes a joint measure of causal influence and competitive significance, subject constraint [C] < K on its size:
C* arg
max CCV. CISK
Σ (w]ll)) + w. -,,S (AS,,;
(2)
WEC
3

---

Published as a conference paper at ICLR 2026
where K is the maximum desived number of Critical Tokens, 9 represents model parameters. and w balances the two measures. The Causal Divergence Deausal (| () is:
N
D Demuaa(wll =
A Σ
- Vo [Sim(w, w/]]l
1=1
and the Competitive Entropy Reduction AS is:
( = -( SS33) E (P)))
Further explanation can be seen Appendix C While Theorem 2.2 provides principled foundation, the direct computation of the causal divergence term, which requires evaluating gradients with respect to all model parameters 6, is computationally prohibitive for large models.
3 METHODOL.OGY
3.1 ALGORITHMIC REALIZATION OF PSV CONSTRUCTION fn
This construction is primarily realized through Critical Tokens (CTs). Consequently, this section is organized into two main parts: the first details the method for identifying CTs, and the second explains how these tokens are utilized construct PSV, corresponding the function fn in Eq.
3.1.1 CRITICALITY SCORE
Translating Theorem 2 into practical algorithm, we devise a Criticality Score for each word w E V. The proof of its validity is discussed detail in Appendix D This score a composite measure reflecting both the global causal influence and the local competitive persistence of w.
Global Causal Contribution (GCC). This component aims to approximate Deausal (wallat (Eq. by quantifying word w's capacity to indirectly shape the reasoning trajectory through sustained high probability in causally interconnected steps. The GCC is formulated as:
M
GCC(w)= Σ
P((w) X
Σ j=it1
aa-s- (w)
The weight A; [S(P:[|P..)) captures the magnitude of change in the models predictive distribution from step i - 1 to i. A large JS divergence signals critical juncture in the reasoning process, Sim P. P.) amplifying the contribution of words prominent such points. The term Os+j Σ Simi Par) represents the normalized semantic influence of the distributional state at step i on that of step j. Here, P.PP, (P, P3) [IP.I||..T is the cosine similarity between the vector representations of probability distributions P; and Py. This factor ensures that the influence of early critical steps is appropriately propagated and weighted in assessing words contribution to later stages of reasoning.
Competitive Persistence Scoring (CPS). This component approximates Eyzi ( (from 4q by rewarding words that not only feature prominently in competitive generation contexts but also maintain this prominence over subsequent steps. The CPS for word calculated as:
CPS(w) Σ
(1-)
Σ f=++1
I(w E top (Pz))
(6)
==1
The term
P. (+a)) inversely weights the contribution by the surprisal of the token t; actually generated at step This rewards contexts where the model makes high-confidence choice, suggesting that such choices are more deliberate and impactful. The core of this reward lies in (w),, which measures the competitive pressure surrounding w at step i:
[L(()) - max L,(w)),
if w t; (i.e., w was selected) if top, (T.) and # 44 (i.e., w close competitor) otherwise (not competitive)
(w)
[I((w) (,,t:)..
4

---

Published as a conference paper at ICLR 2026
When w is the selected token f,, A,(w) is its logit margin the strongest competitor. If w was top-k candidate but not selected, A((w) is its logit difference from the winner t, A smaller (,(w) indicates more intense competition. The reward thus assigns higher rewards to tokens that emerge from, or are central to, highly contested selection points.
Σj=4 I(w E top; (P)))
the number of times w appears among the top-k probability candidates in the M - steps immediately following step i. This serves as empirical validation of w's enduring relevance and freuufrr consideration throughout the local reasoning window, reinforcing its status as a critical element.
Consolidated Criticality Score (CS). The final score synergistically combines these two aspects to provide a holistic measure of token's 's importance.
(S(w) GCC(w) log(1 + CPS(w))
(8)
The set of Critical Tokens C", is then formed by selecting the K tokens with the highest CS values, Fig III illustrated, providing the semantic anchors for the next stage of our methodology. The case study in Appendix [H] examines the distribution of normalized CS for CTs on different datasets, revealing their correspondence with the input and output of the model.
3.1.2 FROM CRITICAL TOKENS TO PRINCIPAL SEMANTIC VECTOR
While the discrete set C' identifies key semantic anchors, it falls short of capturing the holistic, relational logic inherent in complex reasoning. To overcome this limitation, we transform this discrete set of tokens into continuous vector representation, the PSV, that encapsulates the dominant semantic direction of the entire thinking phase.
Let E(.) be the model's token embedding function. We first construct an embedding matrix H K xd by stacking the embeddings of the K identified Critical Tokens from C', where d is the embedding dimension.
H [F(w1), F(W2), F((K))); Vu; E C
We then apply Principal Component Analysis (PCA) H. The first principal component Vi, represents the direction of maximum variance within the embeddings of the most critical tokens. This direction captures their most sigmificant shared semantic properties and reflects the primary axis of the model's reasoning, We define the initial PSV Ro as this first principal component:
R₂ = V1 = (C),(H)
(10)
This initial PSV Ra, described in Definition 2.1 and Fig. II, acts as global semantic compass, providing stable, overarching directional guide for the subsequent answering phase.
3.2
SEMANTICALLY WATERMARK EMBEDDING 9o AND fn
Our framework departs from conventional methods that employ a fixed watermark strength (Kirchen- bauer al. 2023). inspired by Wang al. (025b). Instead, we introduce semantically-adaptie mechanism where the watermark's 's intensity is dynamically modulated based on the alignment of candidate tokens with the current PSV. This allows for strong watermark signature on semantically coherent tokens while minimizing interference with the model's natural generation process.
Dynamic Watermark Strength. At each generation step in the answer phase, we partition the vocabulary V into green list V, and red list V, based standard cryptographic hash of the previous token, following Kirchenbauer et al. (2023). However, instead of applying a fixed bonus to the logits of all green-list tokens, we compute token-specifie bonus & for each candidate token w E y,, This bonus is proportional to the token's 's semantic relevance to the current PSV R₁
E(w)= R₂
S E R.
d = 60 + 8x Swii-1
(11)
where sw.i-1 is the cosine similarity between the embedding of token v and the PSV R2-1- 6g is a base watermark strength, and dg is scaling factor that controls the sensitivity semantic alignment.
5

---

Published as a conference paper at ICLR 2026
Table Experimental results on C4, WMT16-DE-EN, AIME, and GSM8K datasets for Qwen3-32B and Deepseek-R1 1 32B models. We report Perplexity (PPL)(J) for text quality, BLEU and mACC((). short for math ACC, for task performance, and AUC (t) for watermark detection. The best result among watermarking methods for each metric is in bold.
WMT
AIME
GSM8K
Qwen3
Deepseek
Qwen3
Deepseek
Qwen3
Deepseek
Qwen3
Deepseck
Method
PPI.
AUC
PPI.
AUC
BLEU
AUC
BLEU
AUC
MACC
AUC
mACC
AUC
MACC
AUC
MACC
AUC
No Watermark
10.55
10.82
7,851
7,622
70.03
71.52
94.01
95.21
7.351
82.36
69.23
70.67
98.43
92.98
94.16
94.57
UPV
11.4
97.01
11662
97.15
7.493
82.75
7.288
82.50
63.04
86.
64.23
87.46
92.51
81.92
93.67
82.45
Unigram
97.10
96,90
8.441
8.157
56.02
93.27
57.36
93.62
93.88
82.53
94.94
83.07
Unbiased
11.52 93.06
11.92
92.58
7.516
84.50
7.305
84.21
65.51
85.73
66.83
86.26
92.17
80.52
93.21
81.04
SynthID
13.22
6.953
78.15 6.781
52.34
83.12
53.65
83.67
90.53
74.24
91.46
74.88
SWEET
12:46 97.27
12.62
97.20
7.209
85.
7,016
84.88
66.01
99.86
67.
99.89
93.
92.51
94.82
93.13
EWD
7.413
86.80
7.228
86.45
69.52
99.91
95.82
94.76
96.41
WatMe
11.27
98.53
11.67
98.60
8.038
86.93 7,893
86.55
67.03
88.11
68.46
88.53
93.82
84.25
94.87
84.74
MarphMark
11.01
94.16
11.22
94.55
9.752
76.08
9,463
75.82
68.74
88.31
70.17
88.79
93.52
76.76
94.63
77.15
SemStamp
11.42 97.85
11.73
97.65
7.912
85, 20
7,682
84.80
68.90
98.95
70.31
99.15
93.05
94, 80
94.28
95.38
k-SemStamp
11.22
98.10
11.51
97.90
123
85.50
7,886
85.15
69.15
99.22 99.25
70.55
99.35
93.25
94.45
65
SimMark
11.18
97.95
11.46
97.75
8.191
85.40
7,954
85.00
69.05
99.10
70.48
99.23
93.18
94,95
94.39
95.52
ReasonMark
10.31
99.31
10.54
99.52
9.916
87.25
9.653 85.10
69.86
99.95
71.34
99.98
93.96
95.94
95.14
96.56
The logit for green-list token is then modified L,(w) < [,(w) + & This ensures that green-list tokens that are highly aligned with the intended reasoning trajectory receive a stronger watermark, reinforcing logical consistency. If a highly probable, contextually appropriate token falls into the red list, the relatively lower bonuses on green-list altermatives prevent significant quality degradation. The effect of these two parameters on model performance is analyzed in Section 4.5
Dynamic PSV Update. The PSV is not static; it evolves with the generation of the answer to act as a semantic compass, tracking the local semantic context. After a token 4 is generated at step i, we update the PSV using exponential moving average:
R₂ = (1- R. + B(t),,), where B, = Sbase St,,5-1
(12)
The update rate Br is itself adaptive, depending on the semantic contribution of the newly generated token, where Bluse E [0, 1] is small base learning rate, which is also analyzed in Section 4.5 This mechanism ensures that the PSV gradually incorporates the semantic content of the unfolding answer, allowing for smooth topical transitions while remaining anchored to the initial reasoning established in Tinn-
Watermark Detection. A significant advantage of our approach is that the detection process requires no modification to standard procedures in Kirchenbauer et al. (2023). Despite the dynamic nature of the watermark embedding, detection remains stateless and does not require access to the PSV the original prompt. It is performed using the same statistical z-test as in KGW by checking for a statistically significant bias towards green-list tokens in the generated text. The performance gain of the algorithm is attributed to its ability to identify larger set of valid green tokens from the candidate list at each step i, thereby reducing the number of red tokens.
4 EXPERIMENTS
4.1 EXPERIMENTAL SETTINGS
Datasets and Prompts. We evaluate our method on datasets spanning both text generation and reasoning tasks. (1) Our evaluation of text generation encompasses two primary tasks. The first is text completion, for which we adopt the C4 dataset (Raffel et al. 2023), which is widely used in prior watermarking studies. The first 30 tokens of each sample are taken prompts, and the model generates the continuation. The second is machine translation, and we use the WMT16 German-Englis dataset (Bojar et al.) 2016). where the task is to translate German sentences into English. (2) For reasoning, we employ the AIME /Veeraboina] 2023) and GSM8K (Cobbe et al., (02T mathematical benchmark, which provides standardized solutions, enabling rigorous evaluation

---

Published as a conference paper at ICLR 2026
of watermarking in tasks where correctness can be objectively assessed. The prompts used in our experiments are detailed in Appendix [..
Models and Baselines. We conduct experiments with Qwen3-32B (Yang et al. 2025 and DeepSeek-
RI-Distill-Qwent -wwen--eennn--eeee (abbreviated as DeepSeek in the subsequent section) (Guo et al. 2025 models. To ensure a comprehensive comparison, we benchmark
method against a range of representa- methods KGW (Kirchenbauer et al.) 2023).
tive watermarking algorithms, including token-
UPV (Liu et al. 2023a), Unigram (Zhao al.] (023), Unbiased (Hu al. [ SWEET (Lee et al.
2023), EWD (Lu et al. 2024), WatMe (Chen et al. 2024), and MorphMark (Wang et al., 2025b). as
well as semantic- based approaches SemStamp (Hou et al.) 2023), k- x-SemStamp (Hou al. (2024). and SimMark (Dabiriaghdam & Wang 2025). Implementations are facilitated by the MarkLLM (Pan
et al.
2024) repository. Evaluation Metrics are detailed discussed in Appendix F.2
Hyperparameters. For methods requiring parameter (e.g., KGW, Unigram), we set d = 2 by de- fault. And we set 6g- 1.5, 8x 3.0 in Eq. [T] which is analysed Sec For text generation tasks, we apply repetition penalties to reduce duplicate outputs, including the no reeeat_ngramme s ze constraint. For mathematical reasoning tasks, however, we refrain from imposing such penalties, as preliminary experiments showed that these constraints significantly reduce problem-solving accuracy, regardless of watermarking.
4.2 MAIN RESULTS
As presented in Table ReasonMark demonstrates a superior balance between output quality, task performance, and watermark detectability across all evaluated datasets and models, consistently out- performing existing state-of-the-art methods. A comparative analysis inference latency, averaged over multiple executions, is detailed in Appendix F22 The results demonstrate that our method's computational overhead is highly competitive. Furthermore, we provide case studies in Appendix HH and visualization of PSV and CTs in Appendix [F44] examining the identified critical tokens and the embedded watermark to offer qualitative insights into the efficacy of our algorithm.
On text generation tasks, method achieves the lowest perplexity (PPL) the C4 dataset (10.31 for Qwen3-32B and 10.54 for Deepseek-RI 32B), indicating the highest text quality that is nearly on ReasonMark obtains the highest BLEU scores among all watermarking techniques (9.916 and 9,653), showcasing its ability preserve translation fidelity. A more detailed breakdown of the results for various translation metrics can be found in Appendix F.1
par with aaneaatermrrked text. For machine translation WMT16-DE--H
Crucially, in cessoning-intenivve benchmarks, our approach excels maintaining logical integrity. On both AIME and GSM8K, ReasonMark achieves the highest mathematical accuracy (mACC), closely matching or even slightly exceeding the baseline performance without a watermark, while other methods often lead to noticeable degradation in performance. For instance, on the AIME dataset with the Deepseek model, our method scores 71.34 mACC, surpassing all other watermarking techniques and nearing the 71.52 of the non non-watermarked baseline.
Across all these tasks, ReasonMark consistently delivers the highest or near-highest detection rates, with AUC of 99.31 and 99.52 on C4, and over 99.9 on the AIME reasoning task. This empiri- cally validates that our framework effectively resolves the trade-off between semantic integrity and watermark robustness, preserving the performance of reasoning LLMs while embedding strong, detectable signal.
4.3
ATTACK ROBUSTNESS ANALYSIS
In our robustness experiments, we evaluated multiple watermarking algorithms under two attack settings, Al and A2 (Lau et al. 2024) on C4 dataset using Qwen3 model. Attack type A1 applies random word-level perturbations, including insertions, deletions, and synonym substitutions, with 30 of the tokens modified. Attack type A2 consists of semantic- transformations via translation and paraphrasing, which are implemented through calls to the DeepSeek- V3 API. For the translation attack, each text is translated into Chinese and subsequently back into English.
As shown in Fig 2 ReasonMark demonstrates superior robustness against both word-level and semantic-level attacks. Achieving a near near-perfect unattacked AUC of 99.31, it maintains high de- tectability above 93.5 under word deletion, insertion, and synonym replacement. Crucially, it shows
7

---

Published as a conference paper at ICLR 2026
linggam
Tha
Oove paa-i NLN;
Shaetheen (iiii Mi0
jubbi
012
Thrmaaton (4300600120)
M40
Transtoon MUCHO 8425
Thamsation (AACHe T44)) Sandors
Randors
Randim
Randon
0.
03
022
64
6-5
36
0.
0.2
344
66
66
1.0
60
0.2
0.4
0.
0.8
1.0
60
02
CA
25
3.8
Falta Fisstiun Fotts
Fabo Foeitins Rath WoMNEE
Fotis Prodiiin MorphMork
Palte Freetiin Frats ReasonMarr
EWV
1.0
1.0
1.0
1.0
0.5
2.8
2.5
Treg Postig Rtae
Thm Pond Rulk
0.6
WondDvira ALC0
Dest (UDD0S--0
judt
WertCente pUCC
WesSCera ALDVE 9400
4yar poaraaa JUCCI (0
Syrar syyysasaaacss AUCHE9000
Paraptie (MU (A
Paapres (uac (ua
Hesign usa julo Nor))
Febro Peative Pali
Pasiior Hade
Fulax Posdii
Pubve Practvv Paala
Figure 2: ROC curves under different attack methods for various watermarking approaches.
strong resilience to semantic attacks, retaining a high AUC of 82.58 against translation and 70.54 against paraphrasing. This resilience stems from our core principle of embedding the watermark in alignment with the model's reasoning, captured by the PSV. By tying the watermark to the core semantic meaning rather than the syntactic structure, ReasonMark ensures persistence against such modifications, validating the efficacy of our aemantically-groundde
approach in adversarial settings. More experiments regarding machine translation and detailed attack robustness evaluation can be found in Appendix F.1 and Appendix F3 respectively.
4.4 ABLATION STUDY
To validate our core components, we conducted an ab-
lation study in Table with with Qwen3 on C4 dataset. We
Table 2: Ablation study on the C4 dataset.
tested variants by replacing our Critical Token (CT) se-
lection with random sampling (w/o CTs), and by indi- vidually removing the Global Causal Contribution (w/o GCC) and Competitive Persistence Scoring (w/o CPS) modules to evaluate the effect of each components.
Method / Variant
PPL
AUC
No Watermark
10,5488
KGW
12.1503
98.78
WatMe
11.2734
98.53
The results confirm that all components are essential. The full ReasonMark model achieves the best perfor- mance, with the lowest perplexity (10.3080) and a high AUC (0.9931). The most significant performance drop occurred in the w/o CTs variant, where PPL increased to 12.8801. This demonstrates that our principled, baaed token selection is critical for maintaining text quality, as random tokens fail to provide coherent guidance for the watermark. Furthermore, removing the GCC or CPS modules also degrades performance. The absence of GCC (w/o GCC) primarily impacts text quality (PPL. increases to 1 11. 1510), while removing CPS (w/o CPS) leads to a more noticeable drop in watermark detectability (AUC falls to 98.69). However, it is noteworthy that even without these individual modules, the w/o GCC and w/o CPS variants still maintain highly competitive overall performance, matching even surpassing the majority of the baseline methods (such as KGW, WatMe, and SimMark) in both text quality and detectability. This shows that GCC is vital for semantic coherence, and CPS is crucial for embedding robust watermark. In conclusion, the components are synergistic and indispensable for achieving the optimal balance between text quality and detection robustness.
SimMark
11.1783
97.95
ReasonMark
10,3080
99.31
w/o CTs
12,8801
99.21
w/o GCC w/o CPS
11.1510
99.11
11.0597
98.69
8

---

Published as a conference paper at ICLR 2026
4.5 HYPERPARAMETER SENSITIVITY ANALYSIS
Go and Top-k Parameter Analysis. To understand the impact of key hyperparameters on our method's perfor- mance, we conduct a sensitivity analysis for the PSV up- date rate So and the top-k sampling value. Figure iillus- trates how text quality, measured by perplexity, varies with these parameters. The analysis reveals that ReasonMark is robust, showing stable performance across wide range of values for both hyperparameters.
Top
15
20
50
160
12.0
Perplexity
12.0
For the PSV update rate fa. perplexity follows U-shaped curve, starting at 11.1 for a value of 10-3, reaching its minimum of approximately 10.3 around 0.1, and then increasing again. Similarly, the top-k parameter shows that perplexity is highest at small k of 3, drops to its lowest point around k=10, and then gradually rises as increases to 100. Notably, the perplexity of ReasonMark consistently remains well below the KGW baseline across all tested settings, underscoring a persistent advantage in text quality. Critically, the results highlight that with careful tuning, our method's performance can even surpass the non- watermarked baseline. The optimal configuration, with 90 value in the range of 0.01 0.1 and top-k value between 10 and 50, yields perplexity score that is superior to that of the original, wonerrarrarre text. This demonstrates that ReasonMark not only embeds a robust watermark but can also enhance text fluency.
16.0
30'
0.02
0.05
0.1
Figure 3: Visualization of Bo and top-k.
ōu and 8x Interaction Analysis. To maintain the overall watermark strength approximately consistent with other methods in our hyperparameter settings, specifically 8 = 2, as outlined in Section 2 and considering the formulation in Eq. 7 we set d within a range of to 2. This ensures that the overall watermark strength does not deviate sig- nificantly from the baseline methods. Thus, we primarily focus on adjusting the parameter ōx, varying it from 1 to 5. Figure 4 provides a segmented surface visualization that reveals the complex interaction patterns between these critical hyperparameters. The results from the figure indi- cate that variations in 6y have a more substantial impact on the AUC. while variations in òy exert greater influence on the PPL. This observation aligns with our algorithmic design: de ensures a fundamental watermark strength, whereas 6y dynamically adjusts the intensity to assign higher watermark strength to semantically critical tokens, thereby achieving the dual objectives of effective watermark detection and high text quality. Furthermore, although parameter adjustments lead to performance variations, the overall efficacy remains within a stable range, demonstrating the robustness of the ReasonMark algorithm.
325
2.0
34
5.0
Figure 4: Visualization of 6g and 8x-
5 CONCLUSION
In this work, we introduced the ReasonMark, the first watermarking framework specifically designed to protect the outputs of reasoning-based Large Language Models. By distinguishing between the model's internal thinking process and the final answer generation, our method effectively preserves the integrity of the model's reasoning capabilities a critical vulnerability of conventional watermarking techniques. The core innovations of our approach, including the identification of Critical Tokens through principled Criticality Score and their distillation into a continuous Principal Semantic embedding process. This ensures that the watermark
Vector (PSV), allow for semantically-an aligns with the model's own logical trajectory, resolving the persistent trade-off between watermark detectability, text quality, and inference cost. Our experiments confirm that the ReasonMark maintains high-quality, logically coherent outputs and robust watermark detection with minimal inference latency. This work represents significant step towards enabling safe, traceable, and accountable deployment of advanced reasoning LLMs world applications. Usage of LLMs when drafting the manuscript is detailed in Appendix A

---

Published as a conference paper at ICLR 2026
REFERENCES
Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. 202/ IEEE Symposium on Security and Privacy (SP). pp. 121-140.
IEEE, 2021.
Folco Bertini Baldassini, Huy Nguyen, Chhng-Chuup Chang, and Isao Echizen. Cross-attention watermarking of large language models. In ICASSP 2024-2024 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pp. 4625-4629. IEEE, 2024.
Ondřej Bojar, Rajen Chatterjee, Christian Federmann, Yvette Graham, Barry Haddow, Matthias Huck, Antonio Jimeno Yepes, Philipp Koehn, Varvara Logacheva, Christof Monz, Matteo Negri, Aurelie Neveol, Mariana Neves, Martin Popel, Matt Post, Raphael Rubino, Carolina Scarton, Lucia Specia, Marco Turchi, Karin Verspoor, and Marcos Zampieri. Findings of the 2016 conference machine translation. In Proceedings of the First Conference Machine Translation, pp. 131-198, Berlin, Germany, August 2016. Association for Computational Linguistics. URL
http:// http:///www... ac web. www.oorg//atttt www/////////ooooooo.o/ http:////////666600 6/W1
Yapei Chang, Kalpesh Krishna, Amir Houmansadr, John Wieting, and Mohit lyyer. Postmark: A robust blackhox watermark for large language models. arXiv preprint arXiv:2406. 14517, 2024.
Liang Chen, Yatao Bian, Yang Deng, Deng Cai, Shuaiyi Li, Peilin Zhao, and Kam-Fai Wong. Watme: Towards lossless watermarking through lexical redundancy. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 9166-9180, 2024.
Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, al. Training verifiers solve math word problems. arXiv preprint 10. 2021.
Amirhossein Dabiriaghdam and Lele Wang. Simmark: A robust sentence-level similarity-based watermarking algorithm for large language models. arXiv preprint arXiv:2502.0278) 2025.
Agnibh Dasgupta, Abdullah Tanvir, and Xin Zhong. Watermarking language models through language models. arXiv preprint 2rXiv:2411.0009 2024.
Zhiwei Fei, Xiaoyu Shen, Dawei Zhu, Fengzhe Zhou, Zhuo Han, Songyang Zhang, Kai Chen, Zongwen Shen, and Jidong Ge. Lawbench: Benchmarking legal knowledge of large language models. arXiv preprint arXiv:2309. 2023.
Eva Giboulot and Teddy Furon. Watermax: breaking the Ilm watermark detectabblittyrroustness-- quality trade-off. arXiv preprint arXiv:2403. 04888 2024.
Aaron Grattafiori, Abhimanyu Dubey, Abhinay Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et The llama herd of models. arXiv preprint urXiv:2407.21778. 2024.
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-rl: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12945 2025.
Yonghua Hei, Yibo Yan, Shuliang Liu, Huiyu Zhou, Linfeng Zhang, and Xuming Hu. Unlocking speech instruction data potential with query rewriting. arXiv preprini arXiv:2507.08603 2025.
Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. Semstamp: A seman- tic watermark with paraphrastic robustness for text generation. arXiv preprint arXiv:2310.0333 2023.
Abe Bohan Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. k-semstamp: A clustering based semantic watermark for detection of machine-generater text. arXiv preprint arXiv:2402. 11399, 2024.
10

---

Published as a conference paper at ICLR 2026
Xuming Hu, Shuliang Liu, Chenwei Zhang, Shuang Li, Lijie Wen, and Philip S Yu. Hiure: Hi- erarchical exemplar contrastive learning for unsupervised relation extraction. arXiv preprint arXiv:2205.02225, 2022.
Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310. 10666, 2023.
Yu Huang, Junhao Chen, Shuliang Liu, Hanqian Li, Qi Zheng, Xuming Hu, et Video signature: In- In-generation watermarking for latent video diffusion models. arXiv preprint arXiv: 25X:::2506.00655, 2025.
Jiahao Huo, Shuliang Liu, Bin Wang, Junyan Zhang, Yibo Yan, Aiwei Liu, Xuming Hu, and Mingxun Zhou. Pmark: Towards robust and distortion-free semantic-level watermarking with channel constraints. arXiv preprint arXiv:2509. 1057, 2025.
Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Cameey, et al. Openai ol system card. arXiv preprint arXiv:2412.16720, 2024.
Jaroslaw Janas, Pawel Morawiecki, and Josef Pieprzyk. Llm-text watermarking based on lagrange interpolation. arXiv preprint (rxii:2500505512, 2025.
Bowen Jin, Jinsung Yoon, Zhen Qin, Ziqi Wang, Wei Xiong, Yu Meng, Jiawei Han, and Sercan O Arik. Llm alignment as retriever optimization: An information retrieval perspective. arXiv preprint 0rXiv:2502.03699 2025.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pp- 17061-17084, 2023.
Lorenz Kuhn, Yarin Gal, and Sebastian Farquhar. Semantic uncertainty: Linguistic invariances for uncertainty estimation in natural language generation. In International Conference on Learning Representations, 2023.
Michal Kuk and Jakub Harasta. Lims legal aid: Understanding legal needs exhibited through user queries. arXiv preprint arXh::2501.0/711 2025.
Tiziano Labruna, Jon Ander Campos, and Gorka Azkune. When to retrieve: Teaching Ilms to utilize information retrieval effectively, arXiv preprint UIXiv22404.1975, 2024.
Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. Waterfall: Framework for robust and scalable text watermarking and provenance for llms arXiv preprint arXiv:2407.0m 04411, 2024.
Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation. arXiv preprint arXiv:2305.15060, 2023.
Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference-tine intervention: Eliciting truthful answers from a language model. In Advances in Neural Information Processing Systems, volume 36, pp. 41451 1451-41488 41483, 2023a.
Yinheng Li, Shaofei Wang. Han Ding, and Hang Chen. Large language models in finance: A survey. In Proceedings of the fourth ACM international conference on Al in finance, pp. 372-382, 2023b.
Yuqing Liang, Jiancheng Xiao, Wensheng Gan, and Philip S Yu. Watermarking techniques for large language models: survey, arXiv preprint arXiv:2409.0000 00089, 2024.
Zhehui Liao, Maria Antoniak, Inyoung Cheong, Evie Yu-Yen Cheng, Ai-Heng Lee, Kyle Lo, Joseph Chee Chang, and Amy X Zhang. Llms as research tools: A large scale survey of re- searchers' usage and perceptions. arXiv preprint 20..:::441.10002... 2024.
Chin-Yew Lin. ROUGE: A package for automatic evaluation of summaries. In Text Summarization Branches Out, pp. 74-81, Barcelona, Spain, July 2004. Association for Computational Linguistics.
htR.ptt:::/ acc antho ogy. W04-10001111 1013/

---

Published as a conference paper at ICLR 2026
Zipeng Ling, Shuliang Liu, Yuehao Tang, Chen Huang, Gaoyang Jiang, Shenghong Fu, Junqi Yang, Yao Wan, Jiawan Zhang, Kejia Huang, et al. Instruction boundary: Quantifying biases in Ilm reasoning under various coverage. arXiv preprint Stti::2509.2227733 2025a.
Zipeng Ling, Yuchao Tang, Shuliang Liu, Junqi Yang, Shenghong Fu, Chen Huang, Kejia Huang. Yao Wan, Zhichao Hou, and Xuming Hu. Wakenllm: Evaluating reasoning potential and stability in llms via fine- grained henchmarking. arXiv preprint arXiv:2507. /6199, 2025b.
Aiwei Liu, Leyi Pan, Xuming Hu, Shuang Li, Lijie Wen, Irwin King, and S Yu Philip. An unforgeable publicly verifiable watermark for large language models. In The Twelfth International Conference on Learning Representations, 2023a.
Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models. arXiv preprint arXiv:2310.06356 2023b.
Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57(2):1-36, 2024.
Shuliang Liu, Hongyi Liu, Aiwei Liu, Bingchen Duan, Qi Zheng. Yibo Yan, He Geng, Peijie Jiang, Jia Liu, and Xuming Hu. A survey on proactive defense strategies against misinformation in large language models. arXiv preprint arXiv:2507. 05288,, 2025a.
Shuliang Liu, Qi Zheng, Jesse Jiaxi Xu, Yibo Yan, He Geng, Aiwei Liu, Peijic Jiang, Jia Liu, Yik- Cheung Tam, and Xuming Hu. Vla-mark: A cross modal watermark for large vision-language alignment model. arXiv preprint arXiv:2507. 14067, 2025b.
Shuliang Liu, Songbo Yang, Dong Fang. Sihang Jia, Yugi Tang, Lingfeng Su, Ruoshui Peng, Yibo Yan, Xin Zou, and Xuming Hu. Vision-language introspection: Mitigating overconfident hallucinations in mllms via interpretable bi-causal steering. arXiv preprint arXiv:2601. 1559 2026.
Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models. arXiv preprint arXiv:2401.13927, 2024.
Yepeng Liu, Xuandong Zhao, Christopher Kruegel, Dawn Song, and Yuheng Bu, In-context water- marks for large language models. arXiv preprint arXiv:2505. 2025c.
Alejandro Lopez-Lira, Jihoon Kwon, Sangwoon Yoon, Jy-yong Sohn, and Chanyeol Choi. Bridging language models and financial analysis. arXiv preprint arXiv:2503.22693, 2025.
Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. An entropy-based text watermarking detection method. arXiv preprint arXiv:2403. 1 2024.
Minjia Mao, Dongjun Wei, Zeyu Chen, Xiao Fang, and Michael Chau. A watermark for low-entropy and unbiased generation in large language models. arXiv preprint 24t.:24005144004 2024.
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in gpt. In Advances in Neural Information Processing Systems, volume 35, pp. 17359-17372, 2022.
Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. A comprehensive overview of large language models. arXiv preprint arXiv:2307.06435 2023.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems, volume 35, pp. 07730-27744, 2022.
Leyi Pan, Aiwei Liu. Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, et al. Markllm: An open-source toolkit for Ilm watermarking. arXiv preprint arXiv:2405.1000 2024.
12

---

Published as a conference paper at ICLR 2026
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. BLEU: method for automatic evaluation of machine translation. In Pierre Isabelle, Eugene Charniak, and Dekang Lin (eds.), Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, pp. 311-318, Philadelphia, Pennsylvania, USA, 2002. Association for Computational I. Linguistics. doi: 10.31 1155/007083.00733333 URL /latt::://aclanthooo.o..... www.or///02-10000000
Wenjie Qu, Wengrui Zheng, Tianyang Tao, Dong Yin, Yanze Jiang, Zhihua Tian, Wei Zou, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for AI-generated] text. In 34th USENIX Security Symposium (USENIX Security 25), pp. 201-220, 2025.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer, 2023. URL https: att//rriiii..///ii///ee///eeeavv www.wvoorrr.o..oooo....... www./rgg////..o.oo...///.../..be 910. 10683
Saksham Rastogi and Danish Pruthi. Revisiting the robustness of watermarking to paraphrasing attacks. arXiv preprint arXiv:2411.05277 2024.
Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. A robust semantics-based watermark for large language model against paraphrasing. arXiv preprint arXiv:2311.08721, 2023.
Claude E Shannon. A mathematical theory of communication. The Bell system technical journal, 27 (3):379-423, 1948.
Naftali Tishby, Fernando C Pereira, and William Bialek. The information bottleneck method. In Proceedings of the 37th Annual Allerton Conference on Communication, Control, and Computing, pp. 368-377, 1999.
Hemish Veeraboina. Aime problem set 1983-2024, 2023. URL wtwphhttp//// www. kagg com/
Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. Towards codable watermarking for injecting multi-bits information to llms. In The Twelfth International Conference on Learning Representations, 2024.
Yidan Wang, Yubing Ren, Yanan Cao, and Binxing Fang. From trade-off to synergy: A versatile symbiotic watermarking framework for large language models. arXiv preprint arXiv:2505.09924, 2025a.
Zongqi Wang, Tianle Gu, Baoyuan Wu, and Yujuu Yang. Morphmark: Flexible adaptive watermarking for large language models. arXiv preprint arXiv:2505.11541 2025b.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824-24833 2022.
Yichen Wei, Yi Peng, Xiaokun Wang, Weijie Qiu, Wei Shen, Tianyidan Xie, Jiangbo Pei, Jianhao Zhang, Yunzhuo Hao, Xuchen Song, et al. Skywork rlv2: Multimodal hybrid reinforcement 2025.
learning for reasoning. arXiv preprint arXiv:2504.
Liang Wen, Yunke Cai, Fenrui Xiao, Xin He, Qi An, Zhenyu Duan, Yimin Du, Junchen Liu, Lifu Tang, Xiaowei Lv, et al. Light-r1: Curriculum sft, dpo and rl for long cot from scratch and beyond. arXiv preprint
20t.:2233..44 2025.
Ronald J Williams. Simple statistical learning. Machine learning, 8(3):229-256, 1992.
algorithms for connectionist reinforcement
Yihan Wu, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, and Heng Huang. A resilient and accessi- ble Eestributtio-ppeserviin watermark for large language models. arXiv preprint arXiv:2310.07710, 2023.
An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint XXi:25505.09388, 2025.
13

---

Published as a conference paper at ICLR 2026
Ki Yoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit watermark for large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). pp. 4031-4055, 2024.
Junyan Zhang, Yiming Huang, Shuliang Liu, Yubo Gao, and Xuming Hu. Do bert-like bidi- rectional models still perform better on text classification in the era of llms? arXiv preprint arXiv:2505.18215. 2025a.
Junyan Zhang, Shuliang Liu, Aiwei Liu, Yubo Gao, Jungang Li, Xiaojie Gu, and Xuming Hu. Cohemark: A novel sentence-level watermark for enhanced text quality. arXiv preprint arXhv:2504.17309 2025b..
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q. Weinberger, and Yoav Artzi Bertscore: Evaluating text generation with BERT. CoRR, abs/1904.09675, 2019. URL hRLhtt:///aaxxioorr
1904.09673 09675]
Yu Zhang. Shuliang Liu, Xu Yang, and Xuming Hu. Catmark: A context-aware threshold- ing framework for robust cross-task watermarking in large language models. arXiv preprint arXiv:2510.02342, 2025c.
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306. /7439, 2023.
Qi Zheng, Shuliang Liu, Yu Huang, Sihang Jia, Jungang Li, Lyuhao Chen, Junhao Chen, Hanqian Li, Aiwei Liu, Yibo Yan, et al. A visual semantic adaptive watermark grounded by prefix-tuning for large vision-language model. arXiv preprint arXiv:2601.07291, 2026.
Shuang Zhou, Zidu Xu, Mian Zhang, Chunpu Xu, Yawen Guo, Zaifu Zhan, Sirui Ding, Jiashuo Wang. Kaishuai Xu, Yi Fang, et al. Large language models for disease diagnosis: A scoping review. arXiv preprint arXiv:2409. 00097, 2024.
14

---

Published as a conference paper at ICLR 2026
A USE OF LLMS
The Large Language Model (LLM) was utilized to assist in the language editing and polishing of this manuscript. Specifically. its application was confined to correcting grammatical errors, refining sentence structure, and enhancing the overall readability of the text. The LLM was used for any part of the scientific process, including the generation of hypotheses, data analysis, or the interpretation of results. The intellectual content of this paper is entirely the product of the authors, who have reviewed all revisions and take complete responsibility for the work presented.
B DETAILED RELATED WORK
The field of digital watermarking for Large Language Models (LLMs)) has rapidly expanded to address the growing need for content authenticity and intellectual property protection (Liu et al. 2024; 2025a Liang et al. 2024 Ling et al. 2025a). Existing methods can be broadly categorized into three main paradigms: vocabulary
ceatioonnn--bseede semantic-aware, and those specifically targeting the unique challenges of reasoning- rrasenin-bbased models.
B.1 VOCABULARY PARTITIONING-BASER WATERMARKING
The foundational approach in LLM watermarking involves partitioning the model's vocabulary into a green list and red list based cryptographic hash of the preceding tokens. During generation, a positive bias is added to the logits of green-list tokens, embedding detectable statistical signal into the output text. The seminal work by Kirchenbauer et al. (2023) established this paradigm, demonstrating its effectiveness for generating detectable signals even in short text spans.
Numerous variants have since been proposed to improve upon this core idea. Some methods focus on preserving the original output distribution to enhance text quality, employing techniques like reweighting (Hu al. 2023), permutation-
schemes (Wu al., 2023), sampling-aaceptancee protocols (Mao et al., 2024). While adaptive watermarking methods like MorphMark (Wang et al. 20256) balance the trade-off between watermark effectiveness and text quality across the red-greed list partition, they do not modulate the watermark strength in proportion to the varying importance of individual tokens within the green list itself. Others selectively apply watermarking to high-entropy tokens, particularly in specialized domains like code generation (Lee al., 2023). Researchers have also extended this framework to encode multi-bit messages using probability balannce partitioning (Wang et al. 2024) or error-correction codes (Qu al. 2025).
Despite their widespread adoption, vocabulary partitioning methods share a fundamental limitation: their reliance on rseudo-random token selection can inadvertently disrupt the logical flow and semantic consistency of the generated text (Yoo et al.) (024)] Chang et al., 2024). This drawback particularly pronounced in reasoning-intensive models, where even minor perturbations to the chain-of-thought can corrupt the entire reasoning process and lead to an incorrect final answer (Kirchenbauer et 2023).
B.2 SEMANTIC-AWARE AND CONTEXT-GUIDER WATERMARKING
To mitigate the quality degradation issues of vocabulary partitioning, second wave of research has focused on developing semantic-awan and context-guide watermarking techniques. These methods move beyond statistical manipulation of token frequencies and instead operate in the semantic space to embed watermarks in a more natural and robust manner.
One line of work leverages the semantic embedding space directly. For instance, SemaMark (Ren et al., 2023) discretizes the embedding space and uses contrastive learning, while SEMSTAMP (Hou
ctt al. 2023) employs locality-sensitive hashing for semantic partitioning. Other approaches utilize an auxiliary model to guide the watermarking process, such as generating watermark logits from semantic embeddings (Liu et al. 2023b). measuring token distribution entropy to decide when to apply the watermark (Liu & Bu 2024), generating dynamic, context-aware instructions for the LLM to follow (Dasgupta et al. 2024 Zhang et al.) 2225cc b). Post-hoc methods that do not require
access to model internals have also been explored; PORTMARK (Chang et al. 2024) instructs
15

---

Published as a conference paper at ICLR 2026
LLM to insert specific words to embed signal, while In In-Context Watermarking (ICW)
(Liu et al.
2023ch achieves embedding solely through prompt engineering.
While these methods often yield higher text quality and improved robustness against paraphrasing attacks (Rastogi & Pruthi] 2024), they typically introduce significant trade-offs. Many require training
auxiliary models or moditying the model architecture (Baldassini al.] (024), incurring substantial
computational overhead and complexity. Furthermore, most of these approaches are designed for
general text generation and are not specifically tailored to preserve the delicate, step-by-step logical integrity required by reasoning-intensin tasks.
B.3 WATERMARKING FOR REASONING LLMS
The emergence of powerful reasoning LLMs, such DeepSeek-RI (Guo et al. 2025) and Skywork RIV2 [Wei et al. 2025). has introduced a new frontier for watermarking. These models often employ distinct two-phin wwo-phase generation process, producing an internal thinking phase (e.g., chain-of-then chain-of-thought) before delivering the final answer. As noted, applying conventional watermarks uniformly across both phases severely degrade reasoning performance.
nascent body of work has begun to address this specific challenge. These pioneering approaches recognize the importance of the thinking phase and attempt to leverage it for intelligent watermark embedding. For example, some methods extract semantic patterns or critical tokens from the reasoning steps guide the watermarking process the subsequent answer phase (Yoo et al.) 2024; Janas et al., [025 Wang et al.) 2025ap. This strategy aims to align the watermark with the model's s established logical trajectory, thereby preserving coherence.
Our work builds upon this insight but introduces key innovation. Whereas prior methods rely on discrete semantic anchors, we propose distilling the collective essence of the reasoning phase into continuous Principal Semantic Vector (PSV). This vector serves as dynamic semantic compass that guides a cemantically-adaptii embedding mechanism in the answer phase. By modulating the watermark strength based on each token's 's alignment with the overall reasoning trajectory, our framework achieves a superior balance of text quality, logical consistency, and watermark detectability without incurring additional inference latency.
C THEOREM FURTHER EXPLAINED
Theorem 2.2
provides principled basis for identifying tokens that are not merely frequent but are integral to the structure and direction of the models thought process. It posits that the optimal set of Critical Tokens, C*, is found by maximizing the objective function in Eq. 2 This function combines two key aspects: the causal influence of a token and its role in reducing predictive uncertainty, balanced by coefficient W. The maximization is constrained by K, the maximum allowable number of critical tokens, and depends on model parameters 0.
Causal Divergence (Deausil (wrl ()). This term, formally defined in Eq. 3 quantifies the potential global influence of a word w on the reasoning path. Sim(w, (w, w/) measures semantic similarity between and a word sampled from P. The factor X JS(P: (1): is the Jensen-Shannon divergence, weighting steps with significant distributional shifts more heavily. A word w is considered causally critical if infinitesimal perturbations related its semantic embedding (reflected by a large gradient norm of the expected similarity with respect to model parameters 0) would lead to substantial deviations in the overall reasoning trajectory. This term captures the sensitivity of the models reasoning process to the semantic concept embodied by w.
Expected Competitive Entropy Reduction (As=:AA This term measures the extent to which the competitive emergence (or potential emergence) of word w at step i reduces uncertainty in subsequent reasoning steps j. The entropy reduction A (w:) is given by Eq, where S(P,) is the Shannon entropy of the distribution Pj. and S(P  E Top, (P.)) is the conditional Shannon entropy of P, given that w was among the top-k probability candidates in the distribution P,. the (potential) selection of at step i leads to more predictable (lower entropy) state at step it signifies ws role in shaping the reasoning path. The expectation E,>; averages this effect over subsequent steps. The subsequent algorithmic development aims to operationalize these concepts.
16

---

Published as a conference paper at ICLR 2026
D THEORETICAL DERIVATION AND PROOF OF ALGORITHMIC REALIZATION
In this section, we provide a rigorous mathematical derivation demonstrating that the Criticality Score formulated in Eq. 1g.88sa serves tractable surrogate objective for the optimization problem defined in Theorem 2.2 We prove that maximizing the GCC and CPS terms is equivalent to maximizing a variational lower bound of the Causal Divergence and the Entropy Reduction, respectively.
D.1 DERIVATION OF GCC FROM CAUSAL DIVERGENCE
Proposition D.1. Under the assumption of Linear Semantic Propagation, the Global Causal Contri- bution (GCC) is a lower-bound approximation of the Causal Divergence D Deausat (
Proof. Recall the definition of Causal Divergence from Eq.
N Σ A Vi [Sim(w, (/mm..ww))l =1)l
D Donusat (w])))
(13)
This formulation is grounded in the principle that the importance of a model component is best measured by the causal effect of interventions activations. This aligns with Causal Tracing Meng et al. (2022). which identifies critical states via causal mediation analysis. and Inference- Time Intervention et al. (2023a), which demonstrates that steering specific directions in the activation space effectively controls model behavior.
Let (0) Er' [0ir::,imm w')] To estimate the gradient VeJ (0) without intractable backpropaga-
tion through the sampling process, we employ the Log-De Gog-Derivative Trick (Score Function Estimator), a technique standardized LLM optimization (e.g., RLHF) Ouyang al. (2022): Williams (1992):
V g = Eu'n [ w V log (ww")
(14)
By the Souchy-Schhwaz inequality, we bound the squared norm:
[ S Ew'n., [Sim(w, )²) EEw'r, ||| log (((
(15)
The term PP P: Ve log [(( relates to the trace of the Fisher Information Matrix. We invoke the Semantic Propagation Assumption: the sensitivity of the probability distribution (Fisher
Information) projected onto the semantic subspace of token is proportional the propagated probability mass of w in future steps.
Formally, we approximate the gradient impact using the First-order Taylor Expansion of the probabil- ity evolution:
IV log P.(w'))1 ~ Σ
M
OP (P.(ww)
=
n
Σ -=
M
au-jP((w'))
(16)
f=++1
where 02-z represents the attention weights. Substituting this back and assuming Sim(w, w') x wwww
D Dcausat (wll0)
d
2((w)2 Σ
a
(17)
j=it1
M
Pr(w) d
Σ
GGC((w)
(18)
J=i+1
Thus, GCC(w) is tractable first-order approximation of the Causal Divergence.
D.2 DERIVATION OF CPS FROM COMPETITIVE ENTROPY REDUCTION
Proposition D.2. Maximizing the Competitive Persistence Score (CPS) is equivalent to maximizing the lower bound of the Expected Competitive Entropy Reduction AS.
Proof. The objective is to maximize Ezs+ i AA5 (w)), defined as:
AS AS (w) ((,)) H(3 lW Tops (P:)
(19)
17

---

Published as a conference paper at ICLR 2026
Maximizing AS corresponds maximizing Information Gain Shannon 1948 consistent with the Information Bottleneck Principle Tishby et al. (1999). In the context of LLMs, this is equivalent to minimizing Semantic Uncertainty Kuhn et al. (2023), which posits that uncertainty should be measured over semantic equivalence classes rather than raw tokens.
Let & be the event E Topı (P:). We aim minimize H (P))E). According the properties of Semantic Uncertainty, a token that stabilizes the generation into a consistent semantic cluster reduces the entropy of the valid search space. Using Fano's 's Inequality, minimizing entropy is equivalent maximizing the probability mass of the dominant modes (T (Top:). Specifically:
H(2)) - log(( Σ P)(x))+
(20)
Therefore, to minimize future entropy, must maximize the likelihood that w remains in the high- probability region future steps j. We define the Persistence Indicator Iş(w) = I[w E (P)).
The expectation of this indicator approximates the mass concentration:
B[[,(w)|[] x H(P)(E)
(21)
Hmax
Thus, maximizing Ej= T(w E Topp(()) (P;)) directly maximizes the lower bound of the entropy reduction. Furthermore, the term derived from the initial entropy H (P.).
A;(w)) in Eq. acts Confidence Weighting factor
CPS(w) x Σ
E Topa(P3)
(22)
Certainty
Persistence
This confirms that CPS favors tokens that generate low-entropy, semantically stable future trajectories, fulfilling the second condition of Theorem 2.2
E
EXPERIMENTS SET-UP FURTHER EXPLAINED
E. PROMPT FOR RACH DATASETS
Prompt design. The exact prompts used in our experiments are presented verbatim in the boxes below to ensure reproducibilityy and to make the instruction style explicit. Each prompt is intentionally concise and neutral to avoid introducing stylistic bias into model outputs. Placeholders such as (text) and (problem) indicate dataset inputs substituted runtime. All prompts were supplied verbatim to the models; post-processing (trimming, normalization, boxed-answer extraction) follows the pipeline described in the main
Please continue the following text and provide only the continuation without any explanations comments. Here is the given text to do completion: (text)
WMT16 DE-EN
Translate the following German text into English, and provide only the translation without any explanations or comments. Here is the given text translate:
(text)
AIME
Please reason step by step, and put your final answer within \boxed }. Here the problem: (problem)
GSM8K
Please reason step by step, and put your final answer within \boxed }. Here the problem: (problem)
18

---

Published as a conference paper at ICLR 2026
Table Main results the WMT-DE-EN machine translation task. All metrics are the higher the better. The best result among watermarking methods for each metric is in bold.
Model
Method
BLEU
R-1
R-2
R-L
BERT
AUC
No Watermark
7.8508
0.3769
0.1371
0.3468
0.5816
KGW
7.3509
0.3752
0.1477
0.3478
0.5717
82.36
UPV
7.4934
0.3903
0.1401
0.3584
0.5857
82.75
Unigram
8.4412
0.3748
0.1366
0.3404
0.5775
83.26
Unbiased
7.5162
0.3705
0.1314
0.3381
0.5703
84.50
SynthID
6.9533
0.3612
0.1258
0.3295
0.5614
78.15
Qwen3-32B
SWEET
7.2086
0.3654
0.1287
0.3340
0.5651
85.10
EWD
7.4129
0.3681
0.1305
0.3364
0.5688
86.80
WatMe
8.0376
0.4023
0.1619
0.3732
0.5985
86.93
MorphMarkk
9.7515
0.3876
0.1574
0.3545
0.5705
76.08
SemStamp
7.9123
0.3955
0.1450
0.3620
0.5905
85.20
k-SemStamp
8.1225
0.4030
0.1615
0.3738
0.5995
85.50
SimMark
8.1910
0.4050
0.1625
0.3755
0.6010
85.40
ReasonMark 9.9155
0.4297
0.1669
0.3885
0.6110
87.25
No Watermark
7.6215
0.3713
0.1335
0.3412
0.5758
KGW
7.1852
0.3695
0.1413
0.3421
0.5668
81.95
UPV
7.2881
0.3856
0.1364
0.3523
0.5795
82.50
Unigram
8.1573
0.3691
0.1325
0.3357
0.5714
83.01
Unbiased
7.3049
0.3653
0.1278
0.3325
0.5645
84.21
SynthID
6.7814
0.3558
0.1215
0.3236
0.5562
77.86
Deepseek-R1-s -1--22B
SWEET
7.0155
0.3601
0.1246
0.3288
0.5598
84.88
EWD
7.2281
0.3629
0.1268
0.3311
0.5630
86.45
WatMe
7.8931
0.3958
0,1581
0,3675
0.5913
86.55
MorphMark
9.4628
0.3815
0.1528
0.3496
0.5652
75.82
SemStamp
7.6820
0.3880
0,1385
0.3550
0.5825
84.80
k-SemStamp
7.8863
0.3955
0.1580
0.3670
0.5910
85.15
SimMark
7.9542
0.3980
0.1595
0.3705
0.5940
85.00
ReasonMark
9.6533
0.4215
0.1621
0.3805
0.6052
87.10
E.2 EVALUATION METRICS
For C4, the goal is to distinguish between human-written and model-generated text. We report the Area Under the ROC Curve (AUC) the primary detection metric, since is threshold-independen and reflects overall diserininability. To additionally assess fluency, we compute perplexity using Meta-Llama-3,, 1-1-7--n-----4e (Grattafiori et al.) (024) as an oracle model. For I DE-EN, we likewise evaluate detectability with AUC, while measuring translation quality using BLEU (Papineni al. 2002). ROUGE (Lin) 2004). and BERTScore (Zhang et al.) 2019). Specifically, ROUGE- (R-1), ROUGE-2 (R-2), and ROUGE-L (R-L) capture different aspects of lexical overlap: unigram recall, bigram recall, and longest common subsequence respectively. These complementary metrics ensure that watermarking maintains both surface-level and semantic quality. For AIME and GSMSK, we extract answers enclosed in \boxed } (as in Appendix EI.I) via pattern matching and compare them against the gold- standard solutions evaluate task accuracy. Detectability is assessed using AUC, ensuring consistency with other datasets. All results are averaged across multiple runs to reduce variance and improve statistical reliability.
19

---

Published as a conference paper at ICLR 2026
F ADDITIONAL EXPERIMENTAL RESULTS
F.I DETAILED RESULTS ON MACHINE TRANSLATION TASK
Sableppreseme a comprehensive evaluation of various watermarking techniques on the WMT-DE-EN machine translation task, utilizing two distinct large language models: Qwen3-32B and Deepseek- R1-32B. The primary objective is to assess the trade-off between the efficacy of the watermark, measured by the Area Under the Receiver Operating Characteristic Curve (AUC), and the quality of the generated translation, evaluated using BLEU, ROUGE (R-1, R-2, R-L), and BERTScore. Our proposed method, ReasonMark, demonstrates a significant advantage over existing token-based and semantic- baasantic--aedddaeeee approaches, achieving state-of-the-an art performance by preserving translation quality while embedding a robust and detectable watermark.
As shown in Table 3 our method achieves the highest BLEU scores among all watermarking techniques for both the Qwen3-32B (9.9155) and Deepseek-R1- R1-322 (9. 9.6533) models. These scores are notably above the No Watermark baseline (7.8508 for Qwen3-32B and 7.6215 for Deepseek-Re R 32B), indicating a performance increase in translation quality. This superior performance is direct result of our algorithm's 's core design principle: Distilling the Thought, Watermarking the Answer.
Unlike conventional methods that apply watermark throughout the entire generation process, ReasonMark decouples generation into a pristine Thinking Phase and a watermarked Answering Phase. This separation is crucial for complex tasks like machine translation, where the model's internal reasoning (the thinking phase) establishes the logical and semantic foundation of the output. By not interfering with this critical stage, ReasonMark avoids corrupting the model's 's reasoning flow, a common pitfall of token-basee based methods like KGW (Kirchenbauer et al. 2023) which can disrupt logical consistency through pseudo-random biases.
Furthermore, the strength of our watermark is not static; it is dynamically guided by the semantics of the reasoning process itself. We identify Critical Tokens from the thinking phase to construct a Principal Semantic Vector (PSV). This PSV acts as semantic compass during the answering phase, modulating the watermark strength based on candidate token's 'ss alignment with the model's established reasoning trajectory. Consequently, tokens that are semantically coherent with the intended translation receive a stronger watermark, while less aligned tokens are penalized less, mechanism
preserving the naturalness and accuracy of the translation. This semantically- allows ReasonMark to outperform other semantie-based methods like SemStamp and SimMark, which, while improving quality over token-based approaches, do not specifically tailor the watermark to the model's s internal reasoning process.
In addition to leading in translation quality, method also achieves a high watermark detectability, with AUC scores of 87.25 and 87.10 for the two models, respectively. This demonstrates that the semantic-guide approach effectively embeds statistically significant signal without sacrificing output fidelity. In essence, ReasonMark successfully resolves the critical trade-off between watermark detectability and text quality by aligning the watermark with the model's own logical flow, making it an ideal solution for applying watermarks to reasoning-intensive LLMs in real-world applications.
F.2 LATENCY STUDY
The latency evaluation in Table 4 conducted on 200 samples from the C4 dataset, confirms that ReasonMark's advanced capabilities are achieved with remarkable computational efficiency. Our method introduces only a minimal overhead, with an average generation time of 0.06613 seconds per token. This represents a marginal increase of just 8.2 percent over the non-watermarked baseline of 0.06109 seconds. This performance is highly competitive, placing it nearly on par with the fastest laken-based methods like KGW at 0.061 14 seconds, while offering vastly superior semantic robustness. Crucially, ReasonMark establishes a new standard for efficiency among semantic-awan techniques. It is approximately 10 percent faster than competing methods that incur higher latencies, such as SemStamp at 0.07231 seconds and k-SemStamp at 0.07337 seconds. This advantage stems from our framework's 's unique architectural design, which front-loads the main computational work. The process of identifying Critical Tokens and constructing the initial Principal Semantic Vector is one-time operation performed after the thinking phase. Subsequently, the watermarking process during the answering phase relies only on lightweight and highly parallclizable vector operations- similarity and simple moving average update. This approach masterfully avoids
20

---

Published as a conference paper at ICLR 2026
Table 4: Latency evaluation of watermarking methods. The average time per token is computed as total runtime divided by the number of generated tokens. The average runtime average tokens is calculated on 200 samples on C4 dataset.
Method
Average Runtime (s)
Average Tokens
Avg. Time per Token (s)
No Watermark
34.75
568.8
0.06109
KGW
32.01
523.5
0.061 14
UPV
35.97
565.9
0.06356
Unigram
44.43
714.5
0.06218
Unbiased
29.13
474.1
0,06144
SynthID
35.05
565.0
0.06204
SWEET
32.42
524.7
0.06178
EWD
32.80
508.6
0.06442
WatMe
37.26
554.0
0,06725
MorphMark
37,46
481.6
0,07778
SemStamp
40.50
560.1
0.07231
k-SemStamp
41.25
562.2
0.07337
SimMark
40.90
561.3
0,07286
ReasonMark
36.69
554.8
0.06613
Table 5: Robustness evaluation of various watermarking methods the C4 dataset using the Qwen3- 32B model. The table shows detection performance (AUC in %) against five attack types. Higher values indicate greater robustness.
Method
Unattacked
Word-Delete
Word-Insert
Synonym-
Translation
Paraphrase
KGW
98.78
94.41
94.34
94.68
81.28
71.23
UPV
97.01
93.44
91.95
89.66
79.92
67.41
Unigram
97.10
94.75
95.20
91.67
84,25
75.77
Unbiased
93.06
63.67
63.97
60.46
54,78
50.33
SWEET
97.27
84.93
89.72
89.59
74.45
64.55
EWD
99.22
93.59
91.15
92.46
81.07
66.80
WatMe
98.53
93.99
92.23
92.50
80.66
62.31
MorphMark
94.16
86.23
84.56
81.42
72.39
61.99
SemStamp
97.85
94.25
93.40
93.45
82.30
70.40
k-SemStamp
98.10
94.30
93.55
93.62
82.50
70.60
SimMark
97.95
94.28
93.50
93.58
82.45
70.50
ReasonMark
99.31
94.36
93.60
93.52
82.58
70.54
the persistent, per-token computational burden of auxiliary models or complex search algorithms that characterize other semantic methods. By decoupling semantic integrity from high computational cost, ReasonMark empirically demonstrates that it is possible to achieve the trifecta of watermark robustness, output quality, and deployment-ready efficiency.
F.3 DETAILED ATTACK ROBUSTNESS ANALYSIS
The comprehensive robustness evaluation presented in Table:5ann Table Sable/eempiricallyy validates the superior resilience of ReasonMark across two distinct large language models. On the Qwen3-32B model (Table 55. ReasonMark not only achieves the highest AUC of 99.31% in the unattacked setting but also consistently outperforms or matches the bes--pero methods against suite of adversarial attacks. While token-based methods like KGW and EWD show strong initial detectability, their performance degrades under semantic perturbations. leading AUC of 94.36% against word deletion and excels against meaning-preserving attacks, scoring a top-tier 82.58% for translation and 70.54% for paraphrasing. This demonstrates a clear advantage over other semantic-aware competitors like SemStamp and SimMark, which it consistently edges out. This pattern of superiority reinforced on the Deepseek-RR RI model (Table where ReasonMark achieves even higher unattacked AUC of 99.52%. While the Unigram method shows anomalous
contrast, ReasonMark maintains
21

---

Published as a conference paper at ICLR 2026
Table 6: Robustness evaluation of various watermarking methods on the C4 dataset using the model. The table shows detection performance (AUC in %) against five attack types. Higher values indicate greater robustness.
Deepseek-R1-DE
Method
Unattacked
Word-Delete
Word-Insert
Synonym-Replace
Translation
Paraphrase
KGW
98.55
94.18
94.11
94.45
81.05
71.00
UPV
97.15
93.58
92.09
89.80
80.06
67.55
Unigram
96.90
94.55
95,00
91.47
84.05
75.57
Unbiased
92.58
63.19
63.49
60.00
54.30
49.85
SWEET
97.20
84.86
89.65
89.52
74.38
64.48
EWD
99.18
93.55
91.11
92.42
81.03
66.76
WatMe
98.60
94,06
92.30
92.57
80.73
62.38
MorphMark
94,55
86.62
84.95
81.81
72.78
62.38
SemStamp
97.65
94.05
93.20
93.25
82.10
70.20
k-SemStamp
97.90
94.10
93.35
93.42
82.30
70.40
SimMark
97.75
94.08
93.30
93.38
82.25
70.30
ReasonMark
99.52
94.57
93.81
93.73
82.79
70.75
Takens & Directions
Case 1 Cis
Case 2 CTf
Case 4 Cls
Global PC2 (16 59%)
No
Case PC1
1-
Case PC2
-1
0
Global PC1 (59.38%)
Figure 5: PCA visualization of Critical Token embeddings for four cases from the C4 dataset, generated by the Qwen3 model as detailed in Appendix H
strength against semantic attacks on this specific model, ReasonMark demonstrates more consistent, state-of-the-an art performance across the board, ranking first or close second in every attack category. Its performance against translation attacks (82.79%) particularly noteworthy, as this attack vector directly simulates the challenges of machine translation task, highlighting its capability to preserve a detectable signal even after the text has been entirely rephrased in another language and back. This exceptional robustness is direct result of our core methodology: by distilling the reasoning trace into a Principal Semantic Vector (PSV) and embedding the watermark in alignment with the text's core meaning, ReasonMark creates signal that is intrinsically linked to the semantic content rather than its superficial syntactic form. This makes the watermark fundamentally more resilient perturbations, ensuring high-fidelity signal preservation essential for complex, meaning-sensitive applications like machine translation.
F.4 CRITICAL TOKENS VISUALIZATION
Figure@proovdde a compelling visualization that empirically validates our choice of the first principal component of Critical Token, CT, embeddings as the Principal Semantic Vector, or PSV. This biplot illustrates the semantic distribution of CTs from the four distinct C4 dataset cases detailed in Appendix H The visualization from the combined embeddings all CTs from the four cases. This creates a common reference frame representing the overall semantic variance. Then, for each case, local PCA performed
constructed first by establishing global PCA space, derived
22

---

Published as a conference paper at ICLR 2026
independently its own CT's to determine its specific principal semantic directions. These local directions were subsequently projected onto the global PCA space for comparison. The results are illuminating. As shown in the figure, the CTs for each case, differentiated by color and marker style, form visually distinct clusters. This indicates that each reasoning task occupies a unique semantic subspace. More importantly, the first principal component, PC1, depicted by the solid arrows, consistently aligns with the dominant axis of its corresponding CT cluster. For example, the PCI for the blue-colored Case 1 accurately captures the primary direction of variance for the blue circle markers. This demonstrates that the PCI vector effectively distills the main semantic thrust of the model's 's reasoning for specific task. Furthermore, the distinct orientation of the PC1 vectors for different cases highlights the context-specificns of this semantic direction. The vector for Case I points significantly different direction than that of the green-colored Case 3, confirming that the PSV is not a generic, one-size-fits-a vector but rather highly tailored semantic compass for each unique thought process. The second principal components, PC2, are depicted by dashed arrows; they show less consistent alignment and capture a smaller portion of the variance. This reinforces the selection of PC1 as the most informative and stable semantic guide. In contrast, the non-critica tokens, shown grey dots, scattered more broadly without clear clustering, underscoring the semantic concentration captured by our CT selection strategy. In conclusion, this analysis provides strong evidence that the first principal component of CT embeddings serves as ideal PSV, being both representative of the core semantics within a single task and highly discriminative between different reasoning contexts.
G LIMITATIONS
While ReasonMark demonstrates robust performance, we acknowledge the following limitations:
Dependency on Reasoning Quality: Our method relies the "Thinking Phase" to derive the Principal Semantic Vector (PSV). If the model's internal reasoning is extremely short, trivial, or hallucinated, the quality of the PSV may degrade, potentially reducing the semantic coherence of the watermark guidance.
Applicability Scope: The framework is explicitly designed for Reasoning LLMs (RLLMs) that expose distinct chain-of-thought. Applying ReasonMark to standard "black-box" non-reasoning models requires inducing a hidden reasoning step (c.g., via CoT prompting), which may alter the deployment pipeline.
Computational Overhead:
Although the latency increase minimal (~8%) compared to auxiliary model-based methods, the PCA computation and dynamic vector updates introduce a slight overhead compared to purely static, mash-based watermarks like KGW.
H CRITICAL TOKENS CASE STUDY
To further illustrate the model's behavior during the reasoning and answering phases, we present several representative visualization case. The upper panel shows the model's thinking sequence, where each token is color-coded along a continuous spectrum according to its CS score (with the right-hand scale indicating the CS values, as defined(Eq.. S). Based on this representation, we highlight the high-CS tokens after removing stop words: tokens ranked highest are enclosed in red boxes, while those with the next-highest scores are enclosed in blue boxes. The lower panel displays the model's final answer text, in which red and green tokens denote standard vocabulary generations, whereas blue tokens correspond to critical tokens automatically identified by our PSV algorithm during the answering phase.
23

---

Published as a conference paper at ICLR 2026
C4 dataset Case I: MGM Resorts is looking for rebound.
Please continue the following and provide only the continuation without any explanations comments. Here is the given text to do completion: MGM Resorts International (MGM), the largest casino and hotel operator on the Las Vegas Strip, is looking for rebound in the famed
Prompt
<think
Okay
the
continue the given
about
1.00
MSN Resorts International looking for
rebound on the Lae Vegad
Scrap
Let me stazt by understanding the context The origina
lazgest
and hotel operatox think
theze and seeking rebound factors could contribute their rebound Pirst recovery is big one Vegas was hit hard during the pandenic
what
"p and enio
50 naybe they 'ze increasing marketing oz special eventa Also
they night investing in Dew attractions renovations sports
visitors conventions could be
-profile events like
their strategy
Another angle is
the competition Other resorts night be doing sinilar things so
how is MaM di diffenent iating itself Maybe they 'ze focusing on
luxuxy exporiences expanding considering the pricing strategies offering deals to attract both tourists and locals 5 ustainability initiatives could be another point Hany
hotel capacities
econonic elimate
night adjusting
Thinking
companies are going green 50 naybe MGM is implementing ecc "friendly practices
appeal enviromenntally Partners with other businesses celebrities night also be
guests
to boost their profile I should also mention specific examples like opening new propartias or collaborating with new hotel or partnership
intertainment giants For instance with
perforner Additionally mentioning market respense could add depth Need make suze the continuation flows naturally fron the originall text Avoid any Barkdown and keep it concise Check for any zecent news about ansuza accuracy strategied
financial
-225
performance
can
hospitality industry Let structure the continuation with these points in mind </think>
I'll
MGM Resort International (MGMI), the leading casino and lodg- ing operator on the Las Vegas Strip, is seeking for resur- gence in the renowned tourist destination by investing new attrac- tions and leveraging the rising popularity of sports betting and ma- jor events. After enduring a challenging post-pandeic recov- ery marked by fluctuating visitation and high inflation, the company has nounced plans to enhance guest experiences through techological innova- tions, expand its non-gaming offerings, and capitalize the return of large- scale conventions and entertainment acts. Additionally, MGM is explor- ing strategic partnerships and potential acquisitions strengthen its mar- ket position amid increased competition from regional and tribal gaming op- erations.
Answer (Text)
24

---

Published as a conference paper at ICLR 2026
C4 dataset Case 2: Spielberg's 's Bridge of Spies.
Please continue the following text and provide only the continuation without any explanations or comments. Here is the given text to do completion: MANILA, Philippines 2013 Steven Spielberg 2019: 9s Bridge of Spies is an entertaining and engrossing historical drama, that with the luxury of
Prompt
<ehänko Okay the
usez
continue the gäven taxt
about the movie
Bridge
of Splies
Let
start by reading the
existing text carefully The original text starts with review Philippines describing
entertaining historical drama) mentioning the Tuxury of beed to Figure out what the next part would logically be Firat should recall the movia Bridge of Sp ies dizected by Steven Spielberg It about the incident
and
the sentance cuts off there
exchange pilot Francis Gazy
Soviet spy The film stars Foo anks The review
be
praising it so the continuation should maintain that positive tone The phrase with the luxury of ..." auggests that the
zeviewer about to sention some conething that the film quality the luxury of time research
phrases
night
strong cast Since the Film is historica drama maybe they 'ze talking about the detailed zesearch oz the performances Looking at the structure eng
Thinking
sentence Bridge Le is entertaining ing historical drama should complete the thought. Maybe " the luxury of naticulous attention to detail and stellar cast brings the Cold Maz eza to life with gripping authenticity ." That makes sense Then the on talk the performances especially of the film naturally from the given text Avoid introducing new concepts that azen it hinted continuation without explanations thorough enough to nake the review comp lete Let obeck for
with luxury
zeviex
's style anks and pezhaps the thenes need to make suze the continuation flows
the plot ,
-22
Also since the user vanta only but
possible erzors in the suggested continuation Does it fit the original tone ? Yes it 's a standard zeview </think>
structure Alright
should
major studio's resources, delivers on the gripping tale of Cold War in- trigue, moral dilemmas, and the fragile threads of human- ity amid political tension. Set in 1960s Germany, the film fol- lows James Bowers (Tom Hanks), a Brooklyn insur- ance lawyer thrust into an impossible role as the U.S. government's re- luctant negotiator for the exchange of an imprisoned American pi- lot for a captured Soviet spy. Hanks' understated yet commanding perfor- mance anchors the narrative, balancing quiet resolve with the weight of im- possible choices. Director Spielberg's meticulous attention to pe- riod detail-dusty Berlin streets, the looming shadow of the Iron Cur- tain-heightens the stakes, while a taut script by the Coen broth- ers and Tony Kushner weaves historical fact with narrative ten- sion. The film's emotional core, however, lies in Bowers' relation- ship with his family, particularly his estranged wife (Amy Ryan) and chil- dren, whose loyalty to one another becomes counterpoint to the frac- tured trust between nations. With haunting score, visceral ac- tion sequences, and a climax that unfolds in real-time sus- pense on a West Berlin bridge, *Bridge of Spy* stands as a testa- ment to Spielberg's 's ability to humanize history without sacrificing the pulse- pounding urgency that defines his best work.
Answer (Text)
25

---

Published as a conference paper at ICLR 2026
C4 dataset Case 3: Curtain Falls the World Cup for Another Four Years.
Please continue the following and provide only the continuation without any explanations or comments. Here is the given text to do completion: The party over and the curtain has come down on the World Cup for another four years. Ieer Scott Davidson is coming home along with the
Prompt
<thinks Okay let me txy to Eiguze out how to continue this
text
The user provided sentence about World Cup ending and Davidson coming should check if there need complete that thought First
Lrrgiin
along with the ...
context about Scott Devidson M4ybe
he 's a playes oz coach fzon a team that participated in the likely about continuation phrase " IT ez Soott supposed to be 2 expert oz Informaten tion tion Zechnology pezson "? But in the context World Cup that seams add. Alternativaly maybe typo for Flayer
World Cup Since the World Cup mentioned
football
probably
flow naturally from the given
Davidson might be
Maybe I2
pezhaps bit proceed with what la given The sentence atructure
Interpreter context
Coach Without
should The party is ovez ... Scott Davidson is coning hone slong with the coning other players Since the Korld Cup is over it could be the team returning hone Alternativaly naybe be coming home with sports
tricky But since the usez wants only the continuation
part should
Thinking
with Kaybe the tean the tropby if
nenories awards or something else. Given that
the Journey Maybe something like rest of the results
pention
national tean Also considering the Horld Cup 12 his tean didn
18
Min they might be coming home wi without the trophy
they vin that 'x different angle Since keep try continue with rest the squad " and mention the nixed emotions of returning home aftex the tournament Maybe add some thing about the journey and looking forvard to the next World Cup That would make sense and keep the tope [rigina]]
A1 Alternatvvlly
specify
neutral
Let
need smooth and doesa add any explanations Just the Let ne put it all together now </think>
contingation
next
sentences
The party crowd, but not before leaving behind memo- ries that will linger like the final whistle's echo. For Scott, the jour- ney home is bittersweet-a mix of pride in the mo- ments shared and the quiet anticipation
reuniting with fam- ily, the weight of the trophy (or the ab- sence of it) still fresh his mind. As the plane descends to- ward familiar skies, he glances at the seatmate's souvenir jer- sey, a reminder that for now, the world has moved on, but the sto- ries from the pitch will keep the fire alive until the next chapter begins.
Answer (Text)
26

---

Published as a conference paper at ICLR 2026
C4 dataset Case 4: Godrej Forays into the Luxury Home Appliance Sector.
Please continue the following and provide only the continuation without any explanations or comments. Here is the given text to do completion: Godrej Appliances has announced its foray into the Rs 1,000-crore super premium home appliances market through the launch of the new
Prompt
<thinic> Okay
figure
continue
text
The usee provided
tentence
about
God
D
Applianced
entering
the Luupes premium home
applianced
market
with
new
Launch
peed to continue the text logically
Firsb should obeok the
oziginal sentence
sentence
Appliances
into the Ra 8
premium home appliances masket through the Launch the new
So the next part should probably name the product line
specific applianced they 'ze launching Naybe something
like
God
prenium
beed nention
it
premium Righ eend consunerи night about snart
technology energy efficiency design and naybe sustainability
Thinking
Including terms Like AI -powered
energy -efficient, and minimalist
design
Also emphasizing
ivity luxury
target night talk about catering discern ing custoners who top -tier products Maybe add something about setting new benchmark the industry Including quote from company executive
Amportant
should also
text
of executive add credibility narket growth and it
-82
their expectations would be good Pinally company 's commitment to innovation and quality Maybe mention futore plans for expanding the product line need to make suze continuation
stating the
follows oziginal text tone
put all together </think>
God reja Eleganza series, designed to redefine lux- ury in home appliances. The lineup includes smart, energy- efficient, and aesthetically crafted products such Al-powered frigerators, 360-degree induction cooktops, and whisper-quiet, high- capacity washing machines. Emphasizing cutting-edge technol- ogy. the Elegenza series integrates IoT-enabled features, pre- mium stainless steel finishes, and eco-friendly manufacturing pro- cesses. Godreya Group's ' CEO, Adi Godreya, stated, The super premium seg- ment witnessing rapid growth, driven by urban consumers seeking so- phisticated, reliable, and sustainable solutions. Elegenzia is not just prod- uct line but a lifestyle statement for those who de- mand excellence in every aspect of their home. Priced be- tween Rs 50,01 and Rs 3 lakh, the collection targets high-net-worth in- dividuals and design-conscious households, aligning with India's ris- ing aspirational market. With this launch, Godreaj aims to capture a sig- nificant share of the Rs. 11,500 crore home appliances sector, reinforc- ing its commitment to blending innovation with timeless elegance.
Answer (Text)
27

---

Published as a conference paper at ICLR 2026
WM dataset Case
Please translate the following German text into English while preserving all original formatting, style, and special characters. Provide only the translation without any explanations or comments. Here the given text to translate: Tferkei bestellt US-Diplomat wegen Spionageberichts ein,
Prompt
<think>
Okay
usez
German
into
English
original Sonage bes Scht
check
ka
WIF
us
Sp1.
wegen
min The parts here
best 111
wbich in this context probably means xea alls
oz
5um 2001
egen translates to doe to oz because of
-355
Loht togethox the translation would due to espionagel report need to make suze that the structure
report aap Turkey recalls d9 diplonat
putting
is correct and that al1 the terna are accurataly translated Also abyle, which caps aut but in characteze So the us diplonat due to -28
Thinking
user mentioned preserving formttiin
headline The original
keeping
70 ke with
Englich it 's Yurkey without any specia
final translation should be Turkey recalls
espionage report right
best bestlell
diplonatic tazn when country asks its diplomati to return that
accurate Alright, that should be it </think>
Answer
Turkey summons US diplomat due to espionage report
(Text)
28

---

Published as a conference paper at ICLR 2026
WM dataset Case 2
Please translate the following German text into English while preserving all original formatting, style, and special characters. Provide only the translation without any explanations or comments. Here is the given text to translate: Bis dahin gab es in Kollbach im Schulverband K drei Klassen und in Petershausen ffcnf.,
Prompt
<thänk> Okay let 's tackle this tranelation
request
The u15e
159
wants the Gernan text translated into Boglich while preserving al1 fornatting style
special characterd
They
specified
provide only the translation without
explanations
First, '11 look the original German sentence
dah in
gab es in 211 bach Schol yes Band
Peters bauser
X
bach drei
Lassen und in Peters hausen there
ElinE
Breaking it down
-275
point
Until
The locations
bach
Peters bauser with
the Schul vee band being Peters hausen
61
bach The nunbers are
three and five classes
need to make
gaze the structure
original The original
Datera hausen association " School
Schu1
ve:
band
district
Thinking
District
would be appropriate
Putting
-88
it together Ontil then
there
weze three classes in 611
bach
withiin the Peters hausen
x11
X
bach School District and five in any special
hausen fornatting original
should
Peters hausen -T oilll
bach
which '11 keep The numbers are in words 50 tthree and
five are corzect The structure uses
wbich is in the oz
625
so
School District changed
punctuation
translation only add anything else Let double *check the translation ensure accuracy and that the orrigina] neaning is preserved Yes that seens right The key points are the nunber of classes in
Answer (Text)
Until then, there were three classes in Kollbach in the school district Pe- tershausen-Kollee and five in Petershausen.
29

---

Published as a conference paper at ICLR 2026
GSM8K dataset Case |
Prompt
Please reason step by step, and put your final answer within \boxed )- Here is the problem: Mariah 2019s grandma was teaching her to knit. Mariah used 1/4 of skein of yam. Her grandma used 1/2 of a skein yarn. There 364 yards in skein of yarn. How many yards of yarm did they use altogether?
<think>
Okay
let
me tzy to Eiguze out how many Varda of Vazo
Maz
and
har
grandna used hez yards
Lab
has
B 4
Alright
need find out how
Yarde
each of them
used individually and then add then together
xight
First
let me think about Max iah pazt one full
Am
| yards
dividing
by
Let
that calculation
divided
4
Let
Lines
0
is
|
wi
reme Lndainder of B which
1
moxe
So
Wait
that rigght
Lau
check agaän
D
4
divided
grea
yards
Mas
Jah
used
yards
for
granndmal
used
of
sike
im
So halt of
G
yards
To find half of
can
di vivd
by Let
calculate that
2
Eime
2
Tbarefore
grandna
used
yarda
Now
Eind
tbe
total yazda tbey used
thez
need
to
wdd
Mas
iab
5 1
yards and hee
grandma 'x
|
yards
Leit
me
add
them
up
1
breeak it down
0
1
2
2
altogethes
they
yards
let verify
if there
anothes ther way to do this Instead of calculating each
pezson 's yarda separately maybe can add the fractions fizst tiply by
total yarda pez
the tzy
nathod check
get
and her grandmal used 1/0 Adding those fractions together
i
i
2
To add them they need common denominator The
oounon denominabor boz for and is
So
2
equivalent
altogethes they
/
sike Then moltiplying
yards
Let
ne
compute that Pirst divide
by
wbich we
already did earlier and got
3 Then mu Eiply
by
3
ne calculate 80
Same
Okay
indeed
273
yards
which reassuring I think that 's solid 1et me just xecap to make
both nethods lead
the
025
suze didn tt miss anything The problem askeed for the total grandna
yards by Max
ske 1s 0 yards Calcul ating
fraction 1a [yrdd] and adding them gives the result
adding
the fractions first and then calculating the total Both
ways
At
2
don see any nietakes ay celovlations
Div
iding 1
by B
1
2
208
Alternative
adding
and ?
//
0
three -foux the of 3 is 2
Yep that cbecks out
So
think
that ts the conrect answer
Final
Answer
They
used
yarda
yaze
Thinking
Answer (Text)
To determine how many yards of yarn Mariah and her grandma used gether, we begin by analyzing the fraction of the skein used and then con- vert that into yards using the conversion factor provided. Step Un- derstand the Conversion Factor. We are given that: Each skein of yarn contains 364 yards, Mariah used 1 of skein, Her grandma used 1 of a skein. Step 2 Calculate Yards Used by Each Person. Mariah's usage: 363 91 yards, Grandma's 's usage: 364 182 yards. Step 3 Add the Amounts Used by Both: 91 + 182 273 yards. Step 4 Verify the
Total Using Fractional Addition: 1 + 2 21
3 x 364 = 273 yards. This
confirms earlier result. Final Answer: 273
30

---

Published as a conference paper at ICLR 2026
GSM8K dataset Case 2
Please reason step by step, and put your final answer within bboxed. Here is the problem: James decides buy birthday candles for his 2 sons. One of them 12 and the other is years younger. A pack of candles costs $3. How much does James spend on candles?
Prompt
<think> bis
buy birthday
son
is
2
years
old and the other is need to Eiguze out the Lages] of
years
younger
Bro
so First
both
sond to know how many
candles he needs Alright the fixst
2
second
years younger calculate that 2
nicus
right
So the second Ron needed
years old That makes wense Now
the
-05
total number of Candles
would be the sum of both sone plus Let me add those together
age
5o
1
says
pack
of
candles and then the total cost
3
need find how
packs
Tames
needs to buy
Since be needs
b candles and each
pack
has
should divide 2 by
Thinking
2
packs
pack
muleiplying
number
packs by
the coot
pack
will give the total
cost
packs
times
8
each
0
Therefore
Jamen
spenda
on
candles Wait
let
me double -check First 50n
1
second son
candles
divided
packe
1 Yeah
right
don think
made
mistakes here The key was figuring out both ages correctly
and
would by evenly if need Since 2
then caleulating the nunbez packs needed
is
pack
exsact So the total cont is Yep that the it Vinal Anaver AP James spends
renainder:
total
of
boxed
dollars
on
candles </think>
James has two sons: one 12 years old, and the other years younger, mak- ing him 8 years old. To determine the total number of candles needed: The older son needs 12 candles. The younger son needs 8 candles. To- tal candles required: 12 8 20.
Answer (Text)
Candles are sold in packs of 5, each costing 3. To find the num- ber of packs needed:
Total candles required divided by can- dles per pack: 20 div 5= packs.
The total cost for packs is calculated by: Number of packs multi- plied by cost per pack: times = 12.
Thus, James spends 12 dollars on candles.
31


Reviews:
[{"review_id": "ARCoQUTKoC", "reviewer": "Reviewer_ewpN", "summary": "This paper introduces ReasonMark, a semantic-guided watermarking framework tailored for reasoning-intensive language models. By separating the generation into a reasoning (thinking) phase and a watermarked answering phase, the method preserves logical coherence while embedding a robust watermark. A Principal Semantic Vector (PSV), distilled from key reasoning tokens, adaptively guides watermark strength during output generation. Experiments show that ReasonMark outperforms prior methods in text quality, task accuracy, and watermark robustness, with minimal latency overhead.", "questions": "No", "limitations": "", "rating": 2, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper addresses a timely problem: watermarking for reasoning-intensive language models, where tranditional methods often fail to preserve logical coherence.\n\n2. The proposed method is conceptually clear, introducing a separation between thinking and answering phases, guided by a semantically meaningful representation.\n\n3. Experimental results demonstrates improvements in watermark detection and task performance.", "weaknesses": "1. The main concern is that the performance gains appear marginal: improvements of 0.67 in accuracy on reasoning tasks and 0.34% in AUC are relatively small and may not justify the complexity of the method.\n\n2. The distinction between this approach and prior semantic-aware watermarking methods is not clearly articulated. Although the paper critiques existing methods for latency and reliance on auxiliary models, ReasonMark appears to share similar characteristics, and Table 4 shows comparable latency across methods.\n\n3. The presented theorem (2.2) lacks a formal proof and does not seem to provide theoretical guidance for the algorithm’s design.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mqgN8RM7Oh", "reviewer": "Reviewer_P3Dg", "summary": "This paper proposes ReasonMark, a watermarking framework tailored for reasoning-intensive LLMs. It splits generation into an untouched thinking phase and a semantically-guided answering phase, and uses a Criticality Score to select pivotal tokens from the reasoning trace and distills them into a Principal Semantic Vector (PSV) that adaptively modulates watermark strength. This preserves logical coherence while embedding a strong, detectable signal.", "questions": "No, see weakness.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well written.\n2. The proposed method is well designed with reasonable motivations.\n3. The paper presents several nice output examples to help readers get a better sense of the output picture.", "weaknesses": "1. No analysis is performed to verify whether the proposed watermarking method affects the generation quality.\n2. I suggest that the authors add a limitation part to the paper to clarify some possible improvements.\n3. The method is designed specifically for reasoning models. Does this mean that it will not work for a non-thinking model? What if the user turns off the thinking mode? In such a case, how do you select the critical tokens?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DUCaXfKu3q", "reviewer": "Reviewer_bJZK", "summary": "This paper proposes ReasonMark, a semantically guided watermarking framework for Reasoning Large Language Models. The authors argue that existing text watermarking methods are primarily designed for general text generation tasks, and directly applying them to reasoning LLMs may disrupt their internal chain of thought. Therefore, this paper divides the model generation process into two stages: \"Thinking\" and \"Answering,\" embedding the watermark only in the Answering stage. Specifically, the authors first extract critical tokens (CTs) from the Thinking stage, obtain the principal semantic vector (PSV) through PCA, and then adaptively adjust the watermark bias strength based on the semantic similarity between the token and the PSV in the Answering stage.", "questions": "Can current distortion-free or unbiased watermarking be applied for reasoning LLM scenario? If not, could you explain why?", "limitations": "", "rating": 2, "confidence": 5, "soundness": 1, "presentation": 2, "contribution": 2, "strengths": "This paper works on the watermarking for large language models, which is significant for determining provenance and responsibility for generated content.", "weaknesses": "1. The paper does not adequately discuss why existing \"distortion-free watermarks\" such as [1] and [2] cannot be applied to the reasoning LLM scenario, resulting in insufficient motivation to propose a new framework. Besides, although the unbiased sampling technique [3] that the was cited in the paper was claimed inefficient by the authors, there several other unbiased watermarking papers [4] [5] which do not require access to the original LLMs and is efficient.\n\n2. ReasonMark only uses the first principal component (PCA1) of the key token embedding as the main semantic direction, but does not explain why other principal components (such as PCA2) are ignored. If the CT embedding has high noise or contains multiple semantic clusters, PCA1 may only reflect the direction of maximum variance rather than the true semantic main line of reasoning, which may weaken the semantic guidance role of PSV.\n\n3. According to equations (5) and (6), both GCC and CPS involve pairwise comparisons of probability distributions at each step. For large vocabularies and long inference chains, this process is extremely time-consuming in practical deployments. While the paper reports an overall latency increase of approximately 8%, it does not explicitly state whether this includes CT construction and PCA computation time, thus the performance evaluation may be incomplete.\n\n4. As seen in Figure 2, the improvements in ReasonMark's AUC and TPR@1%FPR are small (only about 1–2%). Without statistical significance analysis, such improvements may not be sufficient to demonstrate the method's effectiveness.\n\n5. the parameter $\\delta_{i, w}$ in equation (11) is crucial for performance, but the paper only provides the ranges of $\\delta_0 \\in [1, 2]$ and $\\delta_\\lambda \\in [1, 5]$, without specifying their final set values ​​or their comparability with baselines such as KGW, making the interpretation of the results less transparent.\n\n\n[1] Undetectable Watermarks for Language Models, Miranda Christ et al., COLT 2024\n\n[2] Scalable watermarking for identifying large language model output, Sumanth Dathathri et al., Nature 2024\n\n[3] Unbiased watermark for large language models, Zhengmian Hu et al., ICLR 2024\n\n[4] A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models, Yihan Wu et al., ICML 2024\n\n[5] StealthInk: A Multi-bit and Stealthy Watermark for Large Language Models, Ya Jiang et al., ICML 2025", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "niDy6e8nwH", "reviewer": "Reviewer_aFrC", "summary": "The paper presents a watermarking technique designed for reasoning-intensive large language models (LLMs). The proposed method identifies critical tokens from the reasoning phase and assigns additional weighting to tokens in the green list based on their semantic relevance to these critical tokens. The detection process follows the standard green–red list framework used in prior work. Experimental results demonstrate that the proposed method achieves improved text quality and higher detection accuracy compared to existing approaches.", "questions": "+ How many tokens are used for detecting watermarks?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "+ The topic is interesting and important.\n+ The evaluation results demonstrate its effectiveness.", "weaknesses": "- The threat model could be clarified and illustrated in more detail. It is unclear whether users or adversaries are assumed to have access to the reasoning procedure and whether the reasoning-phase outputs themselves should also be watermarked.\n- The system design appears largely empirical and lacks theoretical grounding. The global causal contribution (GCC) and competitive persistence scoring (CPS) are introduced as empirical measures, but the rationale behind their formulation and their effectiveness in preserving semantic integrity are not fully analyzed. Similarly, the motivation for introducing the principal semantic vector (PSV) and the reasoning for aligning selected tokens with their PSV should be more thoroughly explained.\n- The evaluation does not adequately assess reasoning integrity. While the results include standard text-quality metrics such as PPL, BLEU, and mACC, they do not measure whether the generated text faithfully reflects the underlying reasoning process. Including an evaluation of semantic consistency between reasoning steps and final outputs would strengthen the work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)