PMark: Towards Robust and Distortion-free Semantic-level Watermarking with Channel Constraints
Authors: Jiahao Huo
Shuliang Liu
Bin Wang
Junyan Zhang
Yibo Yan
Aiwei Liu
Xuming Hu
Mingxun Zhou
Venue: ICLR 2026 Poster (2026)
Keywords: Semantic-level Watermark; Text Watermark; AI Security
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Semantic-level watermarking (SWM) for large language models (LLMs) enhances watermarking robustness against text modifications and paraphrasing attacks by treating the sentence as the fundamental unit. However, existing methods still lack strong theoretical guarantees of robustness, and reject-sampling–based generation often introduces significant distribution distortions compared with unwatermarked outputs. In this work, we introduce a new theoretical framework on SWM through the concept of proxy functions (PFs) -- functions that map sentences to scalar values. Building on this framework, we propose **PMark**, a simple yet powerful SWM method that estimates the PF median for the next sentence dynamically through sampling while enforcing multiple PF constraints (which we call channels) to strengthen watermark evidence. Equipped with solid theoretical guarantees, **PMark** achieves the desired distortion-free property and improves the robustness against paraphrasing-style attacks. We also provide an empirically optimized version that further removes the requirement for dynamical median estimation for better sampling efficiency. Experimental results show that **PMark** consistently outperforms existing SWM baselines in both text quality and robustness, offering a more effective paradigm for detecting machine-generated text. The source code is available at https://anonymous.4open.science/r/PMark.

Published as a conference paper at ICLR 2026
PMARK: TOWARDS ROBUST AND DISTORTION-FREE SEMANTIC-LEVEL WATERMARKING WITH CHANNEL CONSTRAINTS
Jiahao Huo', Shuliang Liu Bin Wang", Junyan Zhang Yibo Yan Aiwei Liu Xuming Hu-.2*, Mingxun Zhou²*
'The Hong Kong University of Science and Technology (Guangzhou)
"The Hong Kong University of Science and Technology *Peking University
Naatooal University of Singapore TTiinghua University
j ahhoohuot j8gmai com mingxunzeust.
ABSTRACT
Semantic-level watermarking (SWM) for large language models (LLMs) en- hances watermarking robustness against text modifications and paraphrasing at- tacks by treating the sentence as the fundamental unit. However, existing methods still lack strong theoretical guarantees of robustness, and reject-sampling based generation often introduces significant distribution distortions compared with un- watermarked outputs. In this work, we introduce a new theoretical framework on SWM through the concept of proxy functions (PFs) functions that map sentences to scalar values. Building on this framework, we propose PMARK, a simple yet powerful SWM method that estimates the PF median for the next sentence dy- namically through sampling while enforcing multiple PF constraints (which we call channels) to strengthen watermark evidence. Equipped with solid theoretical guarantees, PMARK achieves the desired distortion property and improves the robustness against paraphrasing- styll attacks. We also provide an empirically optimized version that further removes the requirement for dynamical median es- timation for better sampling efficiency. Experimental results show that PMARK consistently outperforms existing SWM baselines in both text quality and robust- ness, offering a more effective paradigm for detecting machine- genteeegeeerteed text. The source code is available this URL.
INTRODUCTION
The rapid advancements of generative AI (GenAl) techniques (Achiam et al., 2023; Team et al., 2025; Rombach et al., 2022; Liu et al., 2024; Brooks et al., 2024) have transformed content creation across diverse fields (Mittal et al., 2024; Chen et al., 2025; Yang et al., 2024), raising significant con- cerns regarding the traceability of Al Al-generated text and copyright protection (Zhao al., 2024; Wu et al., 2025). Watermarking (Kirchenbauer et al., 2023; Aaronson, 2023), which embeds distinctive patterns into generated content, has emerged as critical solution these challenges.
Token-level watermarking schemes for text generation have been widely studied. The popular Green-Red scheme (Kirchenbauer al., 2023; Zhao et al., 2023a) biases token sampling toward a "green" subset, enabling watermark detection via statistical tests on the frequency of green tokens. However, Green-Red watermarking schemes are inherently biased (Hu et al., 2023), meaning that they deviate from the original sampling distribution of LLMs and may degrade text quality (Hu et al., 2023). Distortion-free methods such as Gumbel Watermarking (Aaronson, 2023) and PRC- based schemes (Christ & Gunn, 2024) have also been explored, typically associated with crypto- graphic techniques such as digital signatures (Rivest et al., 1978). Recently, some studies (Tsur et al., 2025b;a) also discuss the best trade-off between detectability and text quality by maximizing the likelihood of watermark detection while minimizing the distortion of generated text.
Unfortunately, token-level watermarks can be easily removed: attacker can simply ask watermarked model to rephrase the generated text while preserving most of its semantic informa- tion (Hou et al., 2023). To improve robustness against such attacks, semantic-level watermarking (SWM) approaches like SemStamp (Hou et al., 2023; 2024) treat a semantically complete sentence as the fundamental watermarking unit. These methods employ rejection sampling to ensure that gen- erated sentences fall within a valid semantic region of the embedding space, analogous to the green
Co-corrrepoondnng authors: Mingxun Zhou and Xuming Hu.

---

Published as a conference paper at ICLR 2026
Candidate Generation
Distribution Estimation
Green-Roe Partition
Distortion-Free Sampling
Context: ...
Vertical EXI
Horionntal (S)
MaltiChaanee
Sampling
Lacy smiled.
Aali diag (sty)
She felt joy and happinesss
warmly face. surpriaed
Origiial
Pronept
She was surprised friends
Cuntest Updating
Figure 1: Illustration of PMARK pipeline in 2D space, with robustness enhanced by
constraints. Note that we use orthogonal pivots and distortion-free partition in practice.
list in Green-Red watermarking, Nonetheless, this split-and aplit-and-reeec paradigm inherits the distortion drawback of Green-Red watermarking and also introduces additional weaknesses, such as sampling failures when all candidate sentences fall in invalid regions (Zhao et al., 2024).
In this work, we propose new semantic-level watermarking scheme named PMARK with the distortion-free property. To achieve this goal, we first establish solid framework for analyzing SWM schemes based on a core concept called the proxy function (PF). Within this framework, PMARK defines the PF of sentence the cosine similarity between its embedding and pre- defined random vector. The key idea behind PMARK that, given knowledge of certain statistical quantify the probability mass of the valid region and per- being distortion-fres We further
properties of the PF distribution, form a sampling process with a strong theoretical guarantee incorporate multiple channel constraints enhance the density of watermarking evidence, illus- trated in Figure 1. Leveraging the fact that random vectors in high-dimensional spaces are almost always orthogonal (Ruppert, 2004), we show that even when simply estimating the median PF as zero, PMARK still achieves high text quality with an efficient sampling process.
Empirically, our evaluation demonstrates that while PMARK preserves high text quality (PPI, 4.37-4.71), it achieves significantly better robustness against paraphrasing attacks using GPT Para- phraser (OpenAI, 2022), with improvements up to 14.8% and 44.6% over the prior best semantic- level and token-level watermarking schemes, respectively. In terms of sampling efficiency, the online version of PMARK requires only 20% of the resources (measured in token consumption) compared to prior SOTA semantic-level watermarking schemes, while the offline version exhibits even lower consumption, paving the way for weal-world deployment of PMARK in practice. Key contributions of this paper include:
We propose a novel theoretical framework that unifies existing SWMs via the introduction of the proxy function, providing solid analytical foundations for performance evaluation. We identify that sparse watermarking evidence in SWMs negatively impacts adversarial robustness, and address this problem by introducing multiple channel constraints.
We introduce an online version of PMARK that achieves high robustness and is theoretically distortion free under mild prerequisites; we also present an offline version that reduces computational cost while maintaining low distortion.
We conduct comprehensive experiments across a variety of text watermarking tasks across multiple datasets and backbones, validating the effectiveness and efficiency of our method.
2 PRELIMINARIES
In this section, we delve into the problem of Semantic-level Watermarking (SWM), which treats semantically complete sentences as the fundamental unit. We begin by formalizing the problem and defining key concepts, inspired by Hu et al. (2023). See Appendix B for detailed proofs.
Zero- and Multi-bit Watermarks. We write M(T) - y to denote the process of sampling response from the model given an input prompt æ. A watermark generation algorithm is denoted as Generation: (T) + y, where & is the watermark generation key (Zhao et al., 2024). detection algorithm determines whether given text y is watermarked, denoted as Detect(y) - {True, False), J. In this work, we focus on zero-bit watermarks, which embed a single detectable signal (e.g., True or False) into text. In contrast, the concurrent SAEMark (Yu et al., 2025) investigates multi-bit watermarking, which embeds a message m E 10 into text (Lau et al., 2024). A detailed discussion of concurrent studies and related work can be found in Appendix C.
2

---

Published as a conference paper at ICLR 2026
Problem Setup. Let Σ denote the vocabulary set of LLM. We define E' the set of all semanti- cally complete sentences, including the null sentence of length zero. For any E Σ", let 3 denote its token sequence,
[z ................................ 2 | tokenize(s).
At each generation step, the probability of producing the next token In+1 Σ given the current context Fi,..., In is denoted by PM (M
tn)) The joint probability of generating a sequence of m tokens En+1..... fn+m m is expressed as:
m
(m Fn | (1....,,n)) Fn)
II Par(Ents 21...., Zns In+l. In-(-1).
(1)
In the context of SWM, we focus on the probability distribution of the next sentence 8n+1 E Σ given the preceding context 81, $1.-..; Sn, denoted
PM (8n+1 $1,-..,88. 8n) II Par (ar | 81,-.., 8,, x9-1)-
Here (sr(s): Ex + [0. 1] is probability mass function over the countable set Σ" For watermarking, we introduce private key k drawn from key space K, where k E K is randomly sampled from a prior distribution Px (k). The watermarked output of the LLM follows a conditional distribution PM (sn+1 $1..... Sni k). which depends on the preceding context and k.
Sampling-based Semantic-level Watermarking. Directly modeling Pas 81, .1.....8pp is generally intractable since Σ- is infinite. A common approach adopted by SWM methods is to sample a set of i.i.d. candidate sentences .1..... IN ~ Pa $1,...; 8n), and then select candidate Y that carries watermark evidence, Y& SWM, (MM.((()........ The distribution of the watermarked output is then defined as the distribution of Y:
YE ~ Pir (sn+1 S,; k).
(3)
Definition (Single-sentence Distortion-Free). Given a context π = [si...., sn), we say that the watermarked LLM distribution is single-sentence distortion-free relative the original LLM Pai if. for all 8n41 E E,, (M π) Pk(k) PM (5n+1 k)
(4)
REK
This condition means that the marginal distribution of Sn-1, when averaged over all possible water- mark keys k, is identical to unwatermarked distribution under the original model.
Definition (Equivalence via Watermark Code Space). In most cases, Pk (k( designed to induce uniform random sampling over watermark code space F, where ~ Uniform((F) (E). Under this construction, the right side of equation 4 can be equivalently rewritten as:
Pk(k) PM (8n+1 1 [T; k))
Σ BEB
P(ex==0
PM (8x+1 π: TT:))
(5)
KEK
Definition 3 (Probability Measure on E²). Let (E", (E",
) be probability space, where G is
a-algebra over ",, and Pa is the probability measure induced by the model PM D" - [0, 1]. For any measurable subset A C E", the measure (M((A is defined as
(A) Σ (M)(s).
REVISITING SEMANTIC-LEVEL WATERMARKING
3.1 PROXY FUNCTION
Section 2 discusses the sampling-based paradigm SWM, which addresses the challenge of oper- ating over the infinite set Σ. However, to enable rule-based selection among candidate sentence set dt, &N Σ SWM methods require a concrete mapping from the sentence space to the real numbers, since direct computation in the infinite textual space is generally intractable.
Proxy Function. To this end, define function F ; E' + R. referred to the proxy p function, which assigns a real-valued score to each semantically complete sentence. Let denote the range of the proxy function F. We define partition of the range U as P(U) (see Definition 4). Each element E belongs to exactly one subset A, E PUU), denoted as A, = (U)
We also define the inverse mapping of F, denoted by F-1 : U + 2 where 2 is the power set of Et. Each value U thus maps the set of sentences in Σ* that share the same proxy value under
3

---

Published as a conference paper at ICLR 2026
F. denoted (u). Furthermore, the watermark code space is denoted as E E 2P(U), whose element is selected by the watermarking scheme according to a prior distribution ex ~ Pk(E) induced by the key Px(k).
3.2 ANALYSIS OF THE BASELINE
Proxy Function of SemStamp. We first focus on simplified generation process of SemStamp, where the original margin constraint removed for clarity. In SemStamp (Hou et al., 2023), the proxy function is defined as:
F(s) LSH(T(s)) [LSH(((s))] JILSH (T(s)),
(6)
where (u) = sign(t; v) (Indyk Motwani, 1998; Charikar, 2002), {ts i== I...., h C Rd set of randomly initialized vectors, T is text encoder with T(s) E" - Rd, and [ denotes the transformation from binary representation to its corresponding decimal value. Given that the range of F U (1....,23 23 the partition used in SemStamp is defined P(U) [(1),.).... (2*
Sampling- thiiingg-th--slletnng Process. We now reformulate the rejection-sampling process of Sem- Stamp campling-then-seleene process, without loss of generality:
Given a context æ, SemStamp samples candidate sentences from the natural distribution:
W = ( w. ((s] ) i= 1.
For a fixed green ratio such that 7/P(U)) E N4, the watermark code space is defined as = fe 2P()) |el > >[((U))). The watermark code εx is sampled uniformly at ran- dom from ex Un [). implying that each element of P(U) is selected with probability
Y. The green region of Σ is then defined as G {s E Σ* F(s) E Ue}. while the set of valid candidates is V {z; F(x,) Ue}. We assume that V is always non-empty.
A watermarked sentence Y is then uniformly selected from V, where the distribution of the watermarked output
PM (s πt)
Distortionary Distribution of Watermarked Output. Fix context π and let F 2 + U be the proxy function with a finite range U of size M |U] For Vu E U, define its natural mass:
qu) & par (M (u)) (F))
Σ (t((lTT)
Eq(4= 1.
BEF-I(u)
WEU
Fix green ratio y E (0, with 7M N4. The code space consists of all size-m subsets S C U, each chosen uniformly at random. For any S S.U, define the green mass g(S) A Eves qu))
Lemma (Probability Scaling of Green Region). For any fixed green set S S U and any N 1, the distribution of the output sentence Y is independent of N and equals the natural distribution conditioned on F E Specifically, for any 8 E E" with u = F(s),
(M π
u E S,
P(Y -V=SIT,,S)
Q(S)
(8)
u $ S.
Averaging the uniformly random choice of green S yields closed-form expression:
Theorem (Closed-form of Watermarked PMF). For any & E E with u = F(s) U,
PMr s π) = (M [8| T)
Σ
M
{(S)
SCU
where q(u) is defined in equation 7, and M, g, u, U, E FF,FFFF1 are known quantities.
Corollary 2.1. Pir (s T)) is distortion-free if and only if q(u) 1/2 for all E U.
However, the condition in Corollary 2.1 not guaranteed SemStamp, whose embedding space is randomly partitioned. Similar conclusions apply other SWM methods such as k- k-SemStamp and SimMark, with further analysis provided in Appendix D. and E.
3.3 SINGLE- CHLLNEL DISTORTION- FREE SAMPLING
In this section, we present a toy example of a distortion free sampling scheme for next-sentence generation, serving foundation for subsequent sections.
4

---

Published as a conference paper at ICLR 2026
Proxy Function via Pivot Vector. Given text encoder T E" + R and fixed pivot vector E R2, we define the proxy function Fu (s) (v, T(s) || [ which denotes the cosine similarity between the pivot vector and the encoded sentence. The range of F, is [-1,
vT(()
Median-based Sampling. Given context π, we sample N i.id. candidate sentences from the natural distribution: W =x11..... NN 32 Pas(s) π.., where N an even integer. The proxy ==
function F, assigns each candidate a scalar score F = {íi FF ( l......, N). Let m. be the median of F. We partition W into two equal-sized subsets:
Fupper = { f: 2 m.): Flower = {2; fi < mp),
(10)
with ties broken randomly to ensure balance.
Define the watermark code space as E FFuppers Flower). A random seed & E {0, sampled
Fupper. if 1: = 1,
uniformly, and the selected code is ex =
Flower: if k: = O.
The valid sentence set is V= Cx, and the next sentence is sampled uniformly from V: Y ~ Un(V). We denote the operation that selects the half half-partition V from the whole set W based on random seed & and proxy function F, as V D(W
|W]/2.
Theorem 3 (Distortion free on Single Channel), For any context æ, sample N iid. candidates W = {.i,.... "iii....,,,., #N from (- | T), and form half-sets eg: E1 by the median rule. Draw ~ Unif 1) and then sample Y uniformly ek. Then PMt (s π (M |T).
Proof. For any 2g E W, we have
P(Y = x, w) = Σ P(K)P(Y = =x W,K) k - E c + {1/z)
kE(0.1)
Averaging over the randomness of W yields
( TT== Σ P( x4 W) = Par(s) m))
which proves that the single-channel sampling method above is distortion-free.
4 PROPOSED METHOD
4.1 MULTI-CHANNEL CONSTRAINED GENERATION (ONLINE)
Single-Channe Robustness. While Section 3.3 introduces simple distortion freee sampling strat- egy for SWM, it remains vulnerable to paraphrasing attacks.
Theorem 4 (Semantic Robustness on Single Channel). Let s be a watermarked sentence and v E Rd the pivot vector. Suppose an altacker A: >>" E' modifies s such that (T(A(s)), T())) < d. Then the probability that the watermark evidence of is removed by such an attack is bounded by
Pr S μM (s ( 2* F.(s))
[m, 22d, my + v2d)
(11)
The robustness of the entire watermarked text S [si...., snl depends on the specific detection scheme, with a detailed analysis available in Giboulot & Furon (2024). Importantly, compared with teken-level baselines where each token contributes one bit of watermark evidence, the evidence density of SWM in the single-channel setting is extremely sparse. This sparsity results in signifi- cant degradation in detectability under adversarial attacks. To address this limitation, we extend the paradigm to incorporate multiple channel constraints.
Coatt-Chhanell Sampling. Given a pre-defined set of b orthogonal vectors r..... Ub. refer to each pivot as a channel. The proxy function defined on v; is F., (s) = (v,. T(s)), also denoted as F, for simplicity. Specifically, these pivots can be generated from the QR decomposition of matrix. Since this approach relies on dynamic median estimation, we refer to it as the online PMARK.
1. Given a context ग, PMARK samples N candidate sentences from the natural distribution: W {21. ... EN Iz P(s T), i I.....N.
2. For i to update V. = D(V. k, F.), where Vo = W and k; ~ Un((0, 1)).
3. A watermarked sentence Y then uniformly sampled from V,, so that the distribution of the watermarked output is Y ~ Pw (s πτ)
5

---

Published as a conference paper at ICLR 2026
Algorithm 1:
Algorithm 2: PMARK Online Detection
PMARK Online Generation
Input S [ [= ..... s. ; M: (Io R = (ro..))
Input I..M M: prompt x00;
a: threshold 6; Smooth Factor K
encoder T: 7;
Output: True ralse
random seeds R = (rasp)
N₂ - 0: Numi +- T:
sample budget N:
a for t + 1 to do
Output: s(1) ,...,.8
Resample Wi (x(1)) ...., (M) with
Initialize h orthogonal pivots
x00) (ar (0:t-1));
y(1))
for j + to do
for < to T do
Define [s) (0()) T()): fi HDMedian (1)
Sample W'(0 = (x ,..,, 200)
with x0()) Pas (6) s(0:t-1));
J(..)) (s())))
V(0) W(t);
if ((.a)) and 2(t,3) > m then C(t.)) +
for j -
Fs(s) (v66), T(s)))
else if ((t,)) = 0 and 2(t.5) < muss) + 8 then C(.))) +-1
Vo)= +
else
(vii-)) T(u.)) F3) on
12
c(s) + -exp(- exp(-K(xuu.) mani)
channel x(ل);
13
end
end
N₂ + Ng + c(c))i
Select (1) Un(vi (nn(vi)):
1s
end
end
10 end
Ng. 0.5 Neaal
11 return (1) (
return (=> 2. ):
v v..2 Nonaa
Figure 2: PMARK Online Watermarking. Left: Multi-channel constrained generation; Right: De-
tection via soft-2-test.
Remark (Multi-channel Distortion-free). is straightforward to verify that such multi-chamnel sampling is distortion-free, sincefor Va, V,, P(x, V++1) and P(Y =x x W) 1/N.
The complete process for generating watermarked texts described in Algorithm 1. A theoretical analysis outlining the advantages of multi-channel sampling is presented in Appendix B.
4.2 SOFT-3-TEST DETECTION (ONLINE)
We now introduce robust detection scheme for text watermarked with the online PMARK.
1. Sentence Segmentation. The input text is segmented into sentences S [so. $1...., ST] to enable subsequent processing.
2. Median Reconstruction via Sampling. For each sentence 8t (1 1 T), resample i.i.d. from (st $0.-1).
W/ = {æI...., TNN] AN}
3. Online Median Estimation. For each pivot vector e j S b). estimate the median
m((.)) of the values F, (W)) using the Harrell-Davis estimator (Harrell & Davis, 1982).
4. Smooth Counting of Watermark Evidence. To mitigate discrepancies between the medi- ans estimated during generation and detection, we introduce a smooth counting mechanism inspired by (Dabiriaghdam & Wang, 2025). Specifically, given margin threshold 8 > and a smoothing factor K > 0, the watermark evidence contributed by 8 along axis fy is defined
1, (F())) = 1A > - KK]5(s))-mm m/c,)) otherwise.
v (ras) = 0 ( < m(a.)) + +8,
C(t.))
5. Robust Detection via Soft-z-Test. Finally, to determine whether the input text was gen- erated by PMARK, we apply soft-count-based 2-test. The test statistic is computed as
Σ 00.50T
2
where b T the total number of potential watermark bits
V67-0.5-0.5
across channels.
The complete description of the online detection scheme is provided in Algorithm 2.
4.3 OFFLINE PARTITION WITH A PRIOR THRESHOLD
Concentration of Measure. practice, we find the range of is confined to a small interval around zero, [- with 0.08 in most cases. This observation consistent with Lemma 5:

---

Published as a conference paper at ICLR 2026
Lemma 5 (Orthogonality). Let z, y be random vectors drawn uniformly from the unit sphere Sd-1 C CR. Then the angle 9 between them has density
(
pa T( sin d-2 E0 [0,
(12)
Moreover, observe a concentration phenomenon whereby the median remains close zero. Building on this intuition and supporting empirical results, we use zero as an effective prior for the median in the offline PMARK. Experimental results in Section demonstrate the effectiveness of this approximation. A brief analysis of the theoretical impact of this prior assumption is included in Appendix F.
Offline Watermarking with Prior-Median Assumption. Accordingly, we adopt zero as the prior median during both generation and detection, while maintaining the same watermarking rate y for the z-test. For candidate sentence define the binary signal vector
Sig(z) [[fa (x) 0), ..... [f(()) O]],
(13)
and let E 10 denote the random channel seeds. The total watermark evidence contributed by r is
E(x)
Σ (o((=)())r()))
(14)
During generation, we select the sentence that maximizes this watermark evidence. This avoids the computational overhead repeated sampling and the need access the original prompt during de- tection by eliminating dynamical estimation, meaning that the offline detector will function without querying generator. The complete algorithm also provided Appendix F.
EXPERIMENTS
In this section, conduct extensive experiments to answer the following research questions: (RQ1) How does PMARK perform under various attacks? (RQ2) Can PMARK enable high-quality text generation in practice? (RQ3) What is the computational cost of PMARK compared with other SWM baselines? (RQ4) How sensitive is PMARK to its key components or parameters?
5.1 EXPERIMENT SETUP
Dataset and Baselines. Following previous work (Hou al., 2023; Wang al., 2025), eval- uate the performance of PMARK using 500 samples from the C4 (Raffel et al., 2020) and BOOK- SUM (Kryšciński et al., 2021) datasets separately, with OPT-1.3B (Zhang al., 2022) and Mistral- 7B-v0.1 1 (Jiang et al., 2023) as backbone models. Our baselines are based on the official implemen- tation of M. (Pan et al., 2024), including token-level watermarking methods KGW (Kirchen- bauer et al., 2023), UPV (Liu al., 2023a), MorphMark (Wang et al., 2025), SIR (Liu et al., 2023b), EXP (Aaronson, 2023), EXPGumbel (Aaronson, 2023), SynthID (Dathathri et al., 2024), as well as semantic-level baselines SemStamp (Hou et al., 2023), k-SemStamp (Hou et al., 2024), and Sim- Mark (Dabiriaghdam & Wang. 2025). For the PMARK generation process, we set the number of channels to with a sample budget N 64. The hyperparameters of the soft-2-test during detection are set as K = 150 and 5 = 0.001. More implementation details can be found in Appendix G.
Metrics.
Following previous work, text, computed using 2- (Touvron et al., 2023). We also assess watermark effectiveness in terms of detectability (TPR @ 1 1%, AUC) and robustness under sentence-level attacks (Paraphrase Attack by Parrot (Sadasivan et al., 2023), GPT-3.5-turbo (OpenAI, 2022), and Back- Tacck-rranlltionn At- tack by LLAMA-3.1 1-BB (Pan al., 2024; Dubey et al., 2024)). Word-level attacks (Pan al., 2024) such as word deletion and synonym substitution at rates 0.05, 0.15, and 0.30 are also considered. Refer Appendix G.2 for a more detailed discussion of these attacks.
perplexity (PPL) measure the quality of generated
5.2 ROBUSTNESS AND TEXT QUALITY (RQI & RQ2)
To answer RQ1, we comprehensively compare PMARK with seven widely used token-level water- marks and three semantic-level watermarks under various attacks. Table presents comprehensive results of watermarking methods under paraphrase attacks, with Pegasus (Pu et al., 2023), Par- rot (Sadasivan et al., 2023), and GPT-3.5-turte (OpenAI, 2022) as different paraphrasers. Figure 3 illustrates the trade-off between text quality and robustness under tack-translation attacks, while Figure 4 shows the results of various SWM methods under word-level attacks. We provide the following observations (Obs.):

---

Published as a conference paper at ICLR 2026
Table 1: Overall results for baseline methods and PMARK on OPT-1.3B and Mistral-7B across the BOOKSUM and C4 benchmarks. Doc-P denotes Paraphrase Attack, while Pegasus, Parrot, GPT are different paraphrasers. For each attack, we report TP@ TP@FF=1%% %, TP@FP=5% by the standard deviation of @ FP=1% % in light gray. Bold denotes the best result, and underlined denotes the second-best.
and AUC, followed
BOOKSUM
C4
Method
No Altack]
Doc- P (Pggaus)
Doc-P (aamml))
DucPPGPTT
No Altack
Duc-P (Pegasas)
Doc (Parrot)
Doc-I" (GPT)
OPT-1.38
EXP(2022
98.8 0999
4.27165555
54116.055
4.01554330
99,599.999
54,858 29669
21.3391.273.5
EXPGumbbel
49.499949994
12.4/2022916
12.420.052.22
13.02322/444
98669.69995
75.2/446691.8
74.6/11 02/2.
55.666.0996.
KOW (3023)
100.0/1000//00000
144466/56.8
1445.9/55.7
108.0'1000011000
39.357.0/90
51.777.5955
(2022b)
99/6/1000/988
81.2938887.5
516992598.11
89228999
99.820000999.
91.6916695.
K3.49906/77
UPV (3125a)
10010/1000110000
9019956698.77
29.239.299.3
108,0100000100
90.6055
78 75.7/88.4
90.9991
SyuthD (2024)
100:0/100019999
68.296666669
25.44336833.8
1/8/1466055 6865.7
100.0000000999
45.48662/899.
25.4499
6.4/212/66766
MorphMark (2015)
100.0/1000010000
1.8772255.2
1.226 US$
0:4 2151
100.0/00.001000 0
78.699.0997.8
70.00 1/96
46 7776 2/91
SemStamp (2023)
97.7/98.8994
89:093/287.3
90.7993,997.5
79 4/942
99.66611990
35.891.099699
84.4/9 3/96
R-SemStaaii (2024)
99.6//00:1999.
74.5/466977
72.3886.4777
62. 1/72.099522
100/000009910 9
76.689929977
74.3/87 09/7
62.9/78.69441
SimMark (2005)
68. 2/4 0/98.8
23.4/2235 8/84
20 (444 6/87.3
22. 0/40 4
77.69429968 5
11,60558922
6/ 2/84
16.04488/99 5
Onlmme)
07.4/9989998
96899.999
95.4999999966
001000009900
96.2999699988
97.2/99.09998
97.8999699.8
Oitline)
99.49996/998
91.296
95.298.699.5
94 2.9 9996
98.899.8999.8
917794499688
91.499 29900
92.696.299
Mistral-718
EXP (2025)
899.9
47.5261./90
10422.671
99 29905993905
$4 2/42/44 8/84
1 17.4770. 8/72.
EXPGuunbel (2023)
99.6/9969991 7
65.6/77 2/6/77299911
78.885.229 292.8
38 4..45258888 2810
98 18.66666999. 3
71.2/22.000 2/22.0992.5
06,2/77 2/91
40.22155.488 4/82.5
KGW (1023)
100.0/0000/10000
4/9///
90.2/97.3990
35 8168 6/92.
100. 100.0V100.0 (1 100
85.695
8
79 2/92//3 7/98
54,2/76, 7195
(20236)
100.0/000,19999
80..89920099.2 2
41.2/71400 4
57.69334994
K3.2/99
63.4200,89
1PV (2023a)
90.6/100///10000
9/59.0
$3.4776 2/14
82000
71.491 49977
4/77.5
34.0K8.
SuntiD (2024)
100.0/00000/10000
50.2449 2/63.5
A155.5
3.011 5.0500
$2998
47.0056.00576
$1.4/41 4280-7
MurphMakk (202.5)
99.5/100:/100000
68.2/88.9977.
77.490.354 399.4
24.6822888777
98.8/100001100.00
A/9744
7/91,4
SemSSamp (2013)
97.7/98.699.5
82.5898890.3
813995799995.9
77.9996 3/157
09.2/90.09224
S-SemStampp (2054)
$3.0/70 3/94 8
5161 9/01
100/001000099
49.2468.400 49.33
7
41. 2/80.2
SimMark (2025)
78.0/89.0/773
19.8/30.683.66
28.846.2/835
23.
0/88
70.5/89
22,4/31.2/1..3
14. 0/37 3/84
22. 22.844.9/96.
OusiOnllme)
10:001000:/99
96898899.7
968999999977
9
93
95, 8/999
OustOitiin)
92.4/1001199.
41.49974299
94 6999
99.7199889999
90.8955 8/991
91.3 8/19
PPL vs. Doc-T TP@FP=1%
Obs. 1 PMARK demonstrates supe- rior semantic robustness across differ-
EXPGUmBel
SynthiD
Ours(On)+ +
UPV
EXP OOff
ent backbones and benchmarks. As
Doc-T TP@FP=1%
80
KGW
SIR
MorphMark
shown in Table I, PMARK exhibits strong robustness to paraphrase attacks. Specifically, the TP@FP1% % of online PMARK remains above 93.0% across dif- ferent paraphrasers, substantially outper- forming the baselines. For Mistral-7B, the TP@FPIC % on BOOKSUM and C4 after GPT paraphrasing reaches 96.8 and 95.2, exceeding the best SWM baseline SemStamp by 20.8% and 26.0% and the best TWM baseline SIR by 55.6% and 31.8% The offline PMARK also shows strong robustness to paraphrase attacks, with TP@FPI % remaining above 90.8%, consistently ranking second to the online PMARK. A similar conclusion can be drawn from Figure 3, where both online and offline PMARK excel in TP@ % under back- translation attack. Despite few competitive baseline results, such those achieved by KGW when attacked by Pegasus, we argue that online PMark demonstrates near SOTA performance across a variety of paraphrasers, while offline PMark offers highly competitive robustness against paraphrase attacks.
SemStamp
60
K-SmmStamp
40
20
SlmMark
6.5
6.0
5.5
5.0
4.5
PPL( better)
Figure 3: Results of Mistral-7B on the C4 dataset.
Smaller bubbles denote lower PPL.
Obs. @ PMARK achieves supe- rior text generation quality. As shown in Figure 3, the online version of PMARK attains the highest text quality on the BOOKSUM bench- mark, with perplexity lower than the best baseline EXP (Aaronson, 2023) by nearly 0.7 on Mistral-7B. Among prior SWMs, k-SemStamp (Hou et al., 2024) achieves the lowest PPL (around 5.0) on BOOKSUM, yet it still underperforms PMARK by clear margin. We observe similar trends on the C4 dataset: both the online and offline variants of PMARK deliver the highest-quality watermarked text. Similarly, EXP and k-SemStamp remain
Figure 4: TP@FP1% % under Word-D and Word-S attacks.
8

---

Published as a conference paper at ICLR 2026
the strongest token-level and semantic- baselines, respectively. Additional results robustness and text quality are provided in Appendix H.1 and H.2.
Obs. Previous SWM methods are vulnerable to word-level attacks. We also evaluate PMARK under word-level deletion and synonym-substiution attacks with Mistral-7B on BOOK- SUM, as shown in Figure Surprisingly, existing SWMs remain vulnerable to these token-level attacks because their watermark evidence is relatively sparse. As a result, even the reversal of one- bit watermark evidence can cause a large deviation in the z statistic. In our work, we address this problem efficiently by applying multiple channel constraints each sentence, rather than simply in- creasing generation length. Consequently, our method achieves state-of-the- robustness: in online mode, @ FP1 % reaches 98.2% and 99.0% under 15% word deletion and synonym substitution, respectively; in offline mode, the corresponding TP@ FPI % values are 95.2% and 98.6%.
5.3 COMPUTATION CONSUMPTION (RQ3)
Obs. ! Evidence den- sity is eritical for SWM detectability. Table 2 confirms our understand- ing of watermark evidence and sampling efficiency in SWM. evaluated with OPT-1.3B on BOOK- N =32
Table 2: TP@FP1S % across different sample budgets and channel num- bers in online/offline modes.
N/b
b=1
b=2
b=3
b=4
N -
81.0/85.0
97. 07.0/47.0
98.0/83.0
-/-
N =16
84.0/93.0
100.0/90.0
100.0/96.0
100.0/93.0
97.0/99.0
100.0/98.0 O
100.0/98.0
100.0/98.0
SUM. Specifically, online PMARK exhibits a high
66
99.0/95.0
100.0/98.0
100.0/99.0
100.0/100.0
TP@FP' FP% of 98% with extremely limited sampling budget N 8, supported by 3 channels. This suggests that dense watermark evidence is necessary for reducing sampling budget. We also note that offline PMARK requires a budget of 16 to achieve practical detectability, which we attribute to the high risk of prior deviation caused by a limited budget. While Bayesian models can improve accuracy in such probability estimation as shown SynthID, we only present the naive results here and leave related improvements for future work.
Obs. PMARK achieves the remarkable trade-off between token efficiency and performance among SWM methods. To fur- ther verify the efficiency of PMARK, we conducted additional experiments on token efficiency across existing SWM methods at the same detectability level, as shown in Table 3. While SimMark achieves the lowest token con- sumption during watermark generation, it performs poorly without well-tuned hyperparameters, as shown in Table 1. Similarly, k-SemStamp requires fewer tokens than online PMARK, but its robust- ness to paraphrasing is limited. In contrast, SemStamp exhibits the highest robustness to semantic attacks among existing SWMs, but at the cost of an impractical 1694.4 tokens per sentence. As a result, argue that PMARK achieves the best trade-off among SWM methods: the offline mode requires fewer tokens than k-SemStamp while maintaining competitive robustness, and the online mode achieves the highest robustness with only 20% additional token consumption.
Table 3: Token efficiency of SWM methods. T, denotes average token consumption per sentence, while 7, denotes consumption per token.
Method k-Sem
SimMark
Sem Ours(On) Ours(Off)
T.
246.9
186.7
1694.4
315.8
239.7
T.
13.3
8.1
99.3
16.0
12.1
5.4 SENSITIVITY ANALYSIS (RQ4)
Obs. @ Soft-z-test boosts
BOOKSUM
BOOKSUM
(Attackes)
the detection accuracy of online PMARK. We present the parameter sensitivity analysis of two hyperparameters in Figure Results of Doc-P(GPT) are also included for comparison. While the soft-z-test yields stable improvement in robustness compared with the naive z-test (K = +00, = 0), we find it is more beneficial for online PMARK, where increases of 11.9% and 6.4% in attacked TP @ FP1 % are ob-
122
126-3336.2
22.6 41.7
101,000
66.
105,0100.
64 99.8
22.5
$6.8 29.5
91A
45.
54.4
65.
42.6
38.8
infro.0 Figure 5: Performance of Mistral-7B under different hyperparameter
150/0.0
15010.001 1500.001 250/0.002 803
infi0.0
Offiine
Offine
settings (K 150, 250, +oo and d = 0, 0.001..

---

Published as a conference paper at ICLR 2026
served on BOOKSUM and C4, respectively. More results and cases can be found in Appendix H.4.
CONCLUSION
The semantics the next sentence an abstract and complex concept. To effectively estimate indirectly, a proxy function that maps sentences from textual space scalar value is often used, either implicitly or explicitly. Building on this insight, we present a unified perspective on existing SWMs and propose novel distortion-free paradigm based median estimation. Furthermore, we identify that the vulnerability of current SWMs to adversarial attacks arises from the sparsity of watermark evidence. To address this issue, we introduce multi-channel constraints enhance robustness. To the best of our knowledge, this is the first work to provide unified theoretical framework for SWMs, the first distortion-free SWM approach, and the first highlight and realize dense watermark evidence in SWM. Experimental results demonstrate that PMARK consistently outperforms existing SWM baselines in both text quality and robustness, offering more reliable and effective paradigm for semantic-level watermarking.
7
ACKNOWLEDGMENTS
We would like to express gratitude to the Red Bird MPhil Program the Hong Kong University of Science and Technology (Guangzhou) for providing support, resources, and funding, which have been instrumental in the successful completion of this research.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Scott Aaronson.
Simons institute talk on watermarking of large language models, 2023. URL wwwpe//wwawaatttttaaaooooorooeee
2023000---,2----1,, 2023.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023.
Li An, Yujian Liu, Yepeng Liu, Yang Zhang, Yuheng Bu, and Shiyu Chang. Defending Ilm watermarking against spoofing attacks with contrastive representation learning. arXiv preprini AXXv:25044006555. 2025.
Dara Bahri, Michael Wieting, Dana Alon, and Donald Metzler. A watermark for black-box lan- guage models. ArXiv, abs/2410.02099, 2024.
Tim Brooks, Bill Peebles, Connor Holmes, Will DePue, Yufei Guo, Li Jing, David Schnurr, Joc Taylor, Troy Luhman, Eric Luhman, al. Video generation models world simulators. OpenAl Blog, 188):1 2024.
Moses S Charikar. Similarity estimation techniques from rounding algorithms. In Proceedings of the thiry-fourth annual ACM symposium on Theory of computing, pp. 380-388, 2002.
Qiguang Chen, Mingda Yang, Libo Qin, Jinhao Liu, Zheng Yan, Jiannan Guan, Dengyun Peng, Yiyan Ji, Hanjing Li, Mengkang Hu, et al. Ai4research: A survey of artificial intelligence for scientific research. arXiv preprint arXiv:2507.01 0/900, 2025.
Miranda Christ and Sam Gunn. Pseudorandom error-correcting codes. In Annual International Cryptology Conference, pp. 325 347. Springer, 2024.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pp. 1125-1139, PMLR, 2024.
Amirhossein Dabiriaghdam and Lele Wang- Simmark: robust sentence-level similarity- based watermarking algorithm for large language models. arXiv preprint arXiv:2502.0222 2025.
Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang. Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, al. Scalable water- marking for identifying large language model outputs. Nature, (33((833):818-822) 2024.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, al. The Ilama 3 herd of models. arXiv e-prints, pp. arXiv-2407, 2024.
Eva Giboulot and Teddy Furon. Watermax: breaking the Ilm watermark deteccabllity-rrousteess- quality trade-off. Advances in Neural Information Processing Systems, 37:18848-18881, 2024.
Frank E Harrell and CE Davis. A new distribution-free quantile estimator. Biometrika, 69(3):635- 640, 1982.
Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulía Tsvetkov. Sem- stamp: A semantic watermark with paraphrastic robustness for text generation. arXiv preprint arXiv:2310.03991, 2023.
Abe Bohan Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. k-semstamp: A clustering-basse semantic watermark for detection of machine-geme -eeeratee text. arXiv preprint wwXiv:2402.11399 2024.
Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbi- ased watermark for large language models. arXiv preprint arXiv:23100 10669, 2023.
Baihe Huang, Hanlin Zhu, Banghua Zhu, Kanman Ramchandran, Michael I Jordan, Jason D Lee, and Jiantao Jiao. Towards optimal statistical watermarking. arXiv preprint arXiv:2312.09930, 2023.
11

---

Published as a conference paper at ICLR 2026
Piotr Indyk and Rajeev Motwani. Approximate nearest neighbors: towards removing the curse of dimensionality. In Proceedings of the thirtieth annual ACM symposium on Theory of computing, pp. 604-613, 1998.
Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chap- lot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie- Barie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William EI Sayed. Mistral 7b, 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference Machine Learning, pp. 17061-17084. PMLR, 2023.
Wojeiech Kryšeiński, Nazneen Rajani, Divyansh Agarwal, Caiming Xiong, and Dragomir Radev. Booksum: A collection of datasets for long-form narrative summarization. arXiv preprint arXiv:2105.08209, 2021.
Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. Waterfall: Framework for robust and scalable text watermarking. In ICML 2024 Workshop on Foundation Models in the Wild, 2024.
Aiwei Liu, Leyi Pan, Xuming Hu, Shu' ang Li, Lijie Wen, Irwin King, and Philiip Yu. An unforge- able publicly verifiable watermark for large language models. arXiv preprini urXiv:2307.16230 2023a.
Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust water- mark for large language models. arXiv preprint MxXi::33100063565 2023b.
Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437, 2024.
Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models. arXiv preprint 13X2 2024.
Yijian Lu, Aiwei Liu, Dianzhi Yu, Jingjing Li, and Irwin King. An entropy-based text watermarking detection method. arXiv preprint arXiv:2403. 13485, 2024.
Uday Mittal, Siva Sai, Vinay Chamola, et al. A comprehensive review on generative ai for education. IEEE Access, 2024.
Alexander Nemecek, Yuzhou Jiang, and Erman Ayday. Topic-based watermarks for large language models, 2024.
OpenAl. ChatGPT, 2022. URL http:s::/ppeeett..cc///ooo//////
Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, et al. Markllm: An open-source toolkit for Ilm watermarking. arXiv preprint arXiv:2405.1003 2024.
Xiao Pu, Jingyu Zhang, Xiaochuang Han, Yulia Tsvetkov, and Tianxing He. On the zero-shot generalization of machine-generated text detectors. arXiv preprini arXiv:2310.05163 2023.
Wenjie Qu, Wengrui Zheng, Tianyang Tao, Dong Yin, Yanze Jiang, Zhihua Tian, Wei Zou, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for (Al-generated) text. In 34th
USENIX Security Symposium (USENIX Security 25), pp. 201-220, 2025.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1-67, 2020.
Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert- networks. In Proceedings of the 2019 Conference Empirical Methods in Natural Language Processing. Association for Computational Linguistics, 11 2019. URL https:/ //arxiv. org/abs / 908. 10084.
12

---

Published as a conference paper at ICLR 2026
Ronald L Rivest, Adi Shamir, and Leonard Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2): 1978.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
David Ruppert. The elements of statistical learning: data mining, inference, and prediction, 2004.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang. and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprins arXiv:2303. /156, 2023.
Hongjin Su, Weijia Shi, Jungo Kasai, Yizhong Wang, Yushi Hu, Mari Ostendorf, Wen tau Yih, Noah A. Smith, Luke Zettlemoyer, and Tao Yu. One embedder, any task: cnerructionfiinttune text embeddings, 2023. URL https:://// http/arxivv.rrr
2abbs/22222 09741.
Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, et al. Gemma 3 technical report. arXiv preprint 2503 2025.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajiwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307.09288. 2023.
Lloyd N Trefethen and David Bau. Numerical linear algebra. SIAM, 2022.
Dor Tsur, Carol Xuan Long, Claudio Mayrink Verdun, Hsiang Hsu, Chen-Fu Chen, Haim Permuter, Sajani Vithana, and Flavio P Calmon. Heavywater and simplexwater: Watermarking low-entropy text distributions. arXiv preprint arXiv:2506. 06409, 2025a.
Dor Tsur, Carol Xuan Long, Claudio Mayrink Verdun, Hsiang Hsu, Haim Permuter, and Flavio P Calmon. Optimized couplings for watermarking large language models. arXiv preprint arXiv:2505.08878, 2025b.
Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. Towards codable watermarking for injecting multi-bits information to 1lms. arXiv preprint wrXiv:2377.15992 2023.
Zongqi Wang, Tianle Gu, Baoyuan Wu, and Yujiu Yang. Morphmark: Flexible adaptive watermark- ing for large language models. arXiv preprint arXiv:2505.1154/ 2025.
Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. A survey on Ilm-generated text detection: Necessity, methods, and future directions. Computational Linguistics, (1(1):255-338 2025.
Jiahao Xu, Rui Hu, and Zikai Zhang. Majority bit-aware watermarking for large language models. arXiv preprint arXiv:2508.0380 2025.
Xiaojun Xu, Jinghan Jia, Yuanshun Yao, Yang Liu, and Hang Li. Robust multi-bit text watermark with I1m- based paraphrasers. arXiv preprint 03X1v:2412.03/23, 2024a.
Zhenyu Xu, Kun Zhang, and Victor S Sheng. Freqmark: Frequency-based watermark for sentence- level detection of llm-generated text. arXiv preprint arXiv:2410.10876 2024b.
John Yang, Carlos E Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. Swe-agent: Agent-computer interfaces enable automated software engineering. Advances in Neural Information Processing Systems, 37:50528-50652, 2024.
Zhuohao Yu, Xingru Jiang, Weizheng Gu, Yidong Wang, Shikun Zhang, and Wei Ye. Saemark: Mit IIm watermarking with inference-time scaling. arXiv preprint 2rXiv:2508.087) 2025.
Junyan Zhang, Shuliang Liu, Aiwei Liu, Yubo Gao, Jungang Li, Xiaojie Gu, and Xuming Hu. Cohemark: A novel sentence-level watermark for enhanced text quality. arXiv preprint arXiv:2504. 17309, 2025.
13

---

Published as a conference paper at ICLR 2026
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christo- pher Dewan, Mona Diab, Xian Li. Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068, 2022.
Yuehan Zhang, Peizhuo Lv, Yinpeng Liu, Yongqiang Ma, Wei Lu, Xiaofeng Wang, Xiaozhong Liu, and Jiawei Liu. Personamark: Personalized Ilm watermarking for model protection and user attribution. arXiv preprint arXiv:2409.09733, 2024.
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint urXiv2230..1743) 2023a.
Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. In International Conference on Machine Learning, pp. 42187-42199. PMLR, 2023b.
Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze. Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramèr, Somesh Jha, Lei Li, Yu-Xiang Wang, and Dawn Xiaodong Song. Sok: Watermarking for ai-generated content. 2025 IEEE Symposium 2024.
on Security and Privacy (SP), pp.
14

---

Published as a conference paper at ICLR 2026
A USE OF LLMS
We used AI assistants for two purposes: (1) generating routine code and boilerplate functions, which were subsequently reviewed and debugged by humans, and (2) performing grammatical review and sentence-level editing of the manuscript. The research methodology, findings, and analysis were independently proposed and conducted.
B DETAILED DEFINITION AND ADDITIONAL PROOFS
Lemma 6 (Countable). Let be a finite tokenizer vocabulary, and let E' denote the set of all semantically complete sentences (including the null sentence) represented as finte token sequences over Σ. Then D* is countable.
Proof. Since E is finite, fix bijection Σ N₂1 (i.e. the index the tokenizer). Let (ps)k21 be the increasing sequence of prime numbers. Define C:: Σ<o + N by
1.
Ø,
C(6)
(15)
Pk
d(2))1
== ( (11) E EKe.
k=1
(s)) = C(t), the Fundamental Theorem of Arithmetic forces the exponent of each ps to coincide on both sides. Hence |s| = [4] and e(xxx) e(yx) for all k, which implies
ys by bijectivity of e, so s = t. Therefore kww injects into N and is countable. Since E" C MkE is countable as well.
Definition (Partition Set). Let be a non-empty set. partition P(U) of U is a collection of non-empty, pairwise disjoint subsets of U whose union equals U. Formally,
P(U)) {A1,... An)
such that:
A + for all i,
. 4, A3 = for all i + j.
U A U.
Each element u E U belongs to exactly one subset A, E P(U), which we denote as Pu(U) in the main body.
Proof of Lemma 1. Here suppose that q(S) 0 in practice, meaning that reject- sampling will always succeed when is large enough.
Proof. Let E + U be the proxy with finite range U, and fix green set S C U. For U,
q(u) Σ
Pu T), Q(S) Σ PM TT)
(16)
IEF ((w)
FiDEs
Hence
Pr(Y = n. S) = Σ (1 q(5))* PMr(s ④) PM(s π))
for (Fr) E.
(17)
((S)
Proof of Theorem 2. Here the watermark code space is E {S s C U, =), where
[U] M, > and [E| (M).
Proof. Based on equation we have
(s = Σ
P(Y (T,KK) P(ex)
1 (M)
Σ P(Y = p(y=s|T,5)) (18)
EK>Un((E
SEE
From Lemma I.
PMr(s π))
u E S,
P(Y = s S) =
((S)
(19)
0,
u $ S
15

---

Published as a conference paper at ICLR 2026
therefore only sets S containing
F(s) contribute:
(M (s л)) q(S)
PM (s πT)
Par(s ()) (ad)
Σ
(20)
(M
SCU q(S)
WES
|s|= wE8
which is exactly equation 9.
Proof of Corollary 2.1.
Denote equation 9 as PMr (s
π
(ar(s
A))()),
where
A(u)
Σ
1 Eves
M
SCU
IS =ME
So PM (+] TT) is distortion-free if and only if A(u) = for all E U.
Proof.
Sufficiency. If q(u) 1/M for all u, then for every S. (()) Eves ((0) = gg/M 7. Also
(x-) Pr(u () )a)) M 7. Hence
A(u) = M 7
=
which means
(M π) = PMr(s TT)
Necessity. Assume distortion-fred A(u) 1 for all u. Fix two indices # Write the
difference using (+). Denote T S U \ [u, 2). [T] = -1, as a set containing both u and will be neutralized in the difference, thus
A(u) A(v)
Σ (CU) [-|=-1
((()) + Ewer (w) ((0) + Ewer ((w))
(M)
Since f(x) z+0 a strictly decreasing function for any fixed 0, therefore
If q(u) > q(v). then every term in the sum is negative and hence A(u) < A(v).
. If q(u) < q(v), then A(u) A(v).
Distortion-free requires A(u) = A(v). hence we must have g(u) = q(u). Since u, v were arbitrary. all q()) are equal, meaning that ((u) M for every U.
Proof of Theorem
Let |T
T(s)
T(A(a)) [T(A(T)] and
Then the proxy
Top
(0. E [-1,1] and f' = (6 ) E 11.
Proof. For unit vectors, || - F|| = 2- 2(F" < 2d, hence
|f -1- - -
| - V2d.
A flip is possible only the original score sits within the 22d band around the median:
If mml S If' fl S v2d = E [m, V2d, my + V2d.
Therefore,
Prm S pm
8 Σ. F.())) [m, - /2d, m. + v22d)
Proof of Lemma 5.
Proof. Without loss of generality, fix x 61 0... 0). Draw y uniformly on 1d-1 The angle 0 between æ and satisfies cos = y = g(v). For t (-1,1), the set {u E sd-1 g(v) t is (d 2s-hee of radius -i-1z. Its (d 2)-dimessional surface area is
A()) A(5 )) ~=
16

---

Published as a conference paper at ICLR 2026
2x (x+122
where A(-) denotes the surface area, A(S*) =
Hence the probability that T E
r((k + 1)/2)*
t + dt) is proportional to that area times dt.
2 fr(() = 1(S0-1) (1 (1- 1
T (
(1 (1- te 1_111.
r (1
With / -= 0, dt = sin 0d0, and -1 = sin 0. Therefore
r (5)
Pa(0) - fr(cos 0) sin
sin d-a 2- 0, 0 0 [0,]]
T d-11 T
Theorem 7 (Multi-channel Robustness). Let e be an upper bound on p pMr(s E E* [Fo, (s) may1= < 22d) for all channels j. with proxy function independence across channels. Then:
(1 (1-2c)VbT
E| B 2 (1 2c) Var[z'] & 4e(1 - SNR 2
2 2/e(1-c)
Proof. Attack removes evidence in each channel with probability E(d e, Varld =e(1= e)
Total evidence after attack:
B[N" = (T - c),, Var[N'] B76(1
Let X N 0.5bT:
E[ (0.5 e),
Var[X] bT'ee1
By Jensen's 's inequality for convex ||:
X
|[ (1 22) VbT
0.55 67
0.5 bT
For variance bound, approximately N (Jxx x
with μx > 0:
Var X
S oxx
4
Vari2']
Varl1 X
0% 46(1 e)
5T
Signal-to-noies ratio:
E[2"]
(1
2T
SNR
Var
211(11 c)
This theorem demonstrates that increasing the number of channels b improves robustness under the same attack strength. The signal-to-noise ratio grows with vbT, showing that multi-channel constraints enhance detectability. The approximation Var[|XX]] S o is reasonable when μx /x/ox / = VbT 0.5-6 is large, which occurs for typical experimental parameters (b = 4, ~ 10 - 20, e S
Ve(1-c)
0.3), yielding /x 2 2.8. This theoretical analysis complements the empirical results showing PMARK's 's superior robustness against various attacks.
C ADDITIONAL. RELATED WORK
Text watermarking techniques for large language models can be broadly categorized into two main paradigms: token-level methods and sentence-level methods.
C.I TOKEN-LEVEL TEXT WATERMARKING
Token-level watermarking, the more traditional approach, embeds signals by manipulating the prob- ability distribution of tokens during the decoding process. A foundational method in this category partitions the vocabulary into "green" and "red" lists, boosting the probability of green-listed tokens to create a detectable statistical bias (Kirchenbauer et al., 2023). Numerous subsequent works have built upon this concept. For instance, some methods focus on enhancing security and text quality by adaptively watermarking only high-entropy tokens (Liu & Bu, 2024; Lu et al., 2024), while others dynamically adjust watermark strength to balance effectiveness and quality ( (Wang et al., 2025). To improve robustness against spoofing attacks, researchers have explored contrastive representation
17

---

Published as a conference paper at ICLR 2026
learning generate semantic-aware token lists (An et al., 2025). Other variations introduce sig- nals in different domains, such as sinusoidal perturbations in the token probability vector to guard against model distillation (Zhao al., 2023b), frequency- based signals detectable via STFT (Xu et al., 2024b). There are also some token-level watermarking techniques (Giboulot & Furon, 2024; Bahri al., 2024) that introduce scorer select chunk candidates with better detectability, thereby facilitating watermarks for black-box LLMs.
Multi-bit watermarking has also been a significant focus, with techniques employing error- correction codes (Qu et al., 2025), probability balancing (Wang et al., 2023), and majority- list construction (Xu et al., 2025) embed more complex information. Furthermore, some ap- proaches frame watermarking as a problem of hypothesis testing, optimizing detection accuracy by coupling output tokens with pseudo-random generators (H (Huang et al., 2023). Despite their diversity and ingenuity, a fundamental limitation shared by nearly all token-level methods is their vulnerabil- ity to semantic-level attacks. Since the watermark is tied to specific token choices, paraphrasing or modifications can easily disrupt erase the embedded signal.
other
C.2 SENTENCE-LEVEL TEXT WATERMARKING
To address the vulnerability of token-level methods to paraphrasing, sentence-level watermarking (SWM) has emerged as a more robust paradigm. These methods treat entire sentences as the funda- mental unit for embedding information. A pioneering work in this area, SEMSTAMP (Hou et al., 2023), partitions the semantic embedding space using locality-sensitivy hashing and employs rejec- tion sampling to ensure that generated sentences fall into a pre-defined "valid" semantic region. This approach significantly enhances robustness against paraphrastic attacks.
Building this idea, subsequent methods have explored various ways define and select valid semantic regions. For example, SimMark (Dabiriaghdam & Wang, 2025) uses sentence embed- ding similarity, PersonaMark (Zhang al., 2024) hashes sentence structures for personalization, and CoheMark (Zhang et al., 2025) leverages fuzzy c-means clustering and inter-sentence cohesion. Other approaches utilize advanced feature extractors such as sparse autoencoders (Yu et al., 2025) or fine-tuned LLM- based paraphrasers (Xu et al., 2024a) to embed multi-bit watermarks. However, a persistent challenge for most existing SWM techniques is their reliance on rejection sampling. Although effective for ensuring semantic validity, this mechanism often introduces significant dis- tortion to the original text distribution, degrades text quality, and risks sampling failure when no valid candidates are found within reasonable number of attempts. Furthermore, many of these methods lack rigorous theoretical guarantees for their robustness and distortion propertics, a critical gap that our work aims to address.
Concurrent Work. A concurrent work is SAEMark (Yu et al., 2025), which introduces a concept analogous to the proxy function used in our framework, referred to as a "feature extractor." While both approaches share some conceptual similarities, PMARK offers notable advantages in several respects. (1) Task setling. SAEMark targets multi-bit watermarking that embeds additional infor- mation into the generated text, whereas PMARK is designed for single-bit watermarking. (2) Text quality. SAEMark selects sentences based on proximity to a target threshold, which may result in distortion. (3) Robustness. SAEMark embeds watermark signals on a per-sentence basis, which has been shown to be vulnerable to certain attacks in their original work, while PMARK leverages multi-channel constraints to significantly improve resistance to such threats. (4) Flexibility. PMARK allows for greater adaptability through customizable settings such as the pivot vector and the number of channels, which are more difficult to implement effectively within the SAEMark framework.
D ADDITIONAL DISCUSSION
D.1 ROBUST RANDOM SEEDS FOR SEMANTIC-LEVEI WATERMARK
Random Seeds in SWMs. In previous SWM schemes such as SemStamp and k-SemStamp, the random seed for sn is extracted from the proxy value of the previous sentence Sn-1, as shown in Appendix However, this approach may not be truly random, since consecutive sentences often relate to the same topic (Nemecek et al., 2024). Moreover, SimMark (Dabiriaghdam & Wang, 2025) eliminates the use of random seed entirely, relying instead on a fixed green region. These approaches can reduce the randomness of the key k and thus break the assumption in 5. In this work, we use pre-defined random seeds that are de facto bound to specific positions 4. This partially addresses the problem but leaves the challenge of achieving n-shot undetectability (Hu et al., 2023) unresolved.
18

---

Published as a conference paper at ICLR 2026
Definition (Sentence-level n-shot- undetectablee)) For a fixed context n, say that watermarked LLM distribution is n n--sott-undee undetectable compared to the original LLM if. for all s E Σ",
Σ Par(s )) TT) =
Σ 1=1
M T;
REK
Imagine a user asking the model the same question n times. An unwatermarked model or n-shot- undetectable scheme would generate answers T₁, I....,7 i..d. from (M π), while wa- termarking schemes such as SemStamp would always generate answers based on the same k, since the context identical across queries. stronger notion, n-sequence distortion-free is proposed in SynthlD, which removes the requirement of identical contexts in Definition 5.
Definition 6 (Sentence-level n-sequence Distortion-fieet free), For a sequence of n prompts Ti..... n and a sequence of n responses y1, Un E >", we say that watermarked LLM distribution n-sequence distortion-free if. for all E "",
PM T
P(KK Σ (M my k; (T,, vi),..,, ( Vi-1))).
KEK
In token-level watermarking methods such as Unbiased (Hu et al., 2023) and SynthID (Dathathri et al., 2024), this is achieved by skipping previously seen contexts and directly outputting unwater- marked tokens.
However, in semantic-level watermark this is difficult to implement. Using the proxy of the previ- sentence like SemStamp reintroduces the problem of reduced randomness in K. Furthermore, mixing SWM with token-level random seed generators may increase vulnerability to paraphrase at- tacks. Therefore, open problem and leave it for future work. In this work, we directly adopt pre-defined random seeds following Christ al. (2024) to achieve single-shot iisortion-freenes.
consider semantic-level dynamic random seed generation to be challenging
D.2 ROBUSTNESS TO CROSS-SENTENSE PARAPHRASING ATTACK
Context-aware semantic-robust Random Seeds. Based the discussion in Appendix D.1, further explore the potential of pseudo-random, context-aware, yet semantically robust random seeds within the PMARK framework. Specifically, we define b additional orthogonal vectors ç1,.... Çb. which are distinct from the pivot vectors Ui,..., Ut used during sampling. The random seed T(t,s) for sentence 8 is then based on the signal from the last w sentence embed- dings T (8t 1):
((t.)) = [(G, ((s--w:--))) > 0] Si T
||sall (st-(s==)=))) > >
We leave the rigorous analysis of the distribution of these random seeds T(t.i) for future work. However, this approach intuitively more random than seeds directly adapted from the proxy value of the last sentence, as employed by SemStamp and k-SemStamp
Table 4: Results for baseline methods and PMARK OPT-1-3B and Mistral-7B across the C4 and BOOKSUM benchmarks, under extreme paragraph-level paraphrasing attacks by GPT-3.5-turbo. For each dataset and model combination, report TP@ FP=1%, TP=1P=5% and AUC from left to right. Bold denotes the best result, and underlined denotes the second- best..
Method KGW
(C4, OPT-L.3)
(C4, Mistral-7BB 37.82/65. 1./91.62
(BOOKSUM, OPT-L-3)
(BOOKSUM. Mistral-7BB
34.20/68. 84/90.51
2.81/5.64/55.22
42.85/70. 95/90.88
UPY SynthID
59.20/78.98/95 668
10.62/46.42889000
81.56/88.66 66/97.86
$1.56/888666/7788
35.41/60 83/90.51
1.83/25.98/69 998669.14
7.11/12.82/66.33
1.45/17.69/62 15
5.09/12. 19/64,88
KSEMSTAMP
0.00/0881/33.7
0.00/2.26/50.79
2.60/8 44/56.388
9.60/15
9.60/15.96/54.0 96/54.664
Ours(Online)
85 18.46/96.15/97.1 63
96.97/100.00/99.91
$2.30/94.44/97.66
75.00/87. 50/98.1
Ours(OMlinee)
75.00/95.83/98.0
41.67/63.95/91
70.83/82. 1//6.33
71.45/95.65/98
Table 4, we present the results of PMARK under paragraph-level paraphrasing attacks with w = 3,
an attack setting where most existing watermark methods are nearly powerless. The results demon- strate the potential PMARK under extreme cross-sentence paraphrasing attacks, where 1) Online PMARK exhibits remarkable TPR @ FPR1% 75% across different backbones and datasets; 2) Offline PMARK maintains a highly competitive performance compared with baselines.
@PR@FPRI%
19

---

Published as a conference paper at ICLR 2026
Experiment Details. The prompt used to instruct gpt-3.5-turbo for paragraph-Ievel paraphrasing
as follows:
<system>
You are a helpful assistant rewrite the text.
</system>
<user>
Please rewrite the following text, avoiding the use of same words or phrases as the original text as much as possible.
You are able to merge sentences or change their order: (whole_text]
</user>
<Original Watermarked text>
The troupe's s goal is to transform Passepartout into a clown-like character. Passepartout's 's story starts in the medieval town of Qeynan. He is being held captive by a man named Laidrin. He is a sorcerer who makes Passepartout into a clown-like character.
Passepartout's story begins with a peasant, Fath, who has been betrayed by the king's men. Fath flees with his wife <is_watermarkes True>
<Detected Text after Attack>
The troupe aims to transform Passepartout into a clown-like figure. The story begins in the medieval town of Qeynan, where Passepartout is held captive by Laidrin, turning him into clownish character. Meanwhile, a peasant named Fath, betrayed by the king's men, flees into the forest with <Is <Ts_watermarked: True>
sorcerer who casts a spell on him,
E ANALYSIS OF EXISTING SWM METHODS
In Section 2, we presented a brief analysis existing SWM methods, whose core lies in the proxy functions they employ.
SemStamp. Specifically, the proxy function of SemStamp can be defined as
FsemStam LSH(T(s)) = [LSH, || LSH,,((s))]]
where (SH = sign(u, v) (Indyk & Motwani, 1998; Charikar, 2002), {ur C Id is set of randomly initialized vectors, and
text encoder with T(s) E Rd. The Green Region G, for each sentence position f. is then defined as
G = U'|: 7 2 U' Shur) where Shuffle(U; r) denotes shuffling the ordered list U with random seed r, and is large prime. k-SemStamp. For S-mStttmp (Hou et al., 2023),
Yt r== q-
u T(s)
SemSStamm argmax
|| |[((s)]
where {uy} are cluster centers obtained via k-means clustering the entire dataset. Similar to SemStamp (Hou et al., 2023), the Green Region G, is given by
G, = U' r 2d), U' ShuffleUU;r)), == g- F((c-)))
SimMark. For SimMark (Dabiriaghdam Wang, 2025),
T(s--1) T(s))
FsimMark (St) [|T(s;-1)]l (s:)]]
where 8t-1 is the previous sentence. A fixed interval then used as the Green Region. Under the cosine similarity used above, G, is always
G, |0.68, 0.76).
Such pre-defined threshold carries high risk that valid candidate sentence has proxy lying within the Green Region. Moreover, these carefully tuned hyperparameters may perform poorly in other settings, shown in Table 1.
20

---

Published as a conference paper at ICLR 2026
F OFFLINE ALGORITHM
To describe the generation and detection process of the offline version of PMARK more precisely, we illustrate it in pseudocode, as shown Figure 6.
Theorem 8 (Distortion Bound of Offline PMark). Let Pj = (f, x). lps 0.5l S 6
διv 1/2 2 E.ex- [P (s x) (M x)}. Then δτv I f single-chane case.
Proof. For single-channel case:
(M ( = Par(s T) Par(s T)
Ff) 0
2p
Ff) <0
2(-pp)
Therefore,
81v =
Σ
Par(s T)
- +
Σ
Par(s α))
2
2p
2(1
(=)20)))00
s:Fa (3)<0
[1 2p
11 2pl
1
1
2pl
-1- 2pl
[
2pl
+ (1 -1-
(21)
2
2p
2(1
2
2
2
2
Since 1p 0.5 S, 2pl < 2e, thus δTV
For the multi-channel offline PMark, the generation process selects the sentence with the highest
watermark evidence score score(s) Σÿ=1 FF. (e)20 Ty- The distortion depends on the joint distribution of the proxy function values across channels.
Assuming that the proxy functions are orthogonal and that the signs F.y (e)>0 independent
across channels for a random sentence 5, the score distribution can be analyzed. If pj = 0.5 for all the selection is uniform, and distortion is zero. If [p, 0.5| S e. the distortion can be bounded by considering the probability that the score deviates from its expectation. Empirical results show that the perplexity of offfine PMark is close to that of the unwatermarked text, indicating that is small in practice, and thus the distortion is negligible.
G IMPLEMENTATION DETAILS
G.1 BASELINES
MarkLLM. We use the official implementation of MarkLLM (Pan et al., 2024)' to reproduce the results of various token-level baselines, including KGW (Kirchenbauer et al., 2023), UPV (Liu et al., 2023a), MorphMark (Wang et al., 2025), SIR (Liu et al., 2023b), EXP (Aaronson, 2023), EXPGumbel (Aaronson, 2023), and SynthID (Dathathri al., 2024). During generation, we set max-new.tokens to 256, comparable to the generation length used by semantic-lever methods. The temperature and top are fixed at 0.7 and 0.95, respectively, across all experiments to ensure fair comparison. In addition, for baselines that depend on external networks (c.g., SIR (Liu et al., 2023b) and UPV (Liu al., 2023a)), we use the official weights provided by MarkLLM.
k-SemStamp. We adapt the official k-SemStamp implementation from MarkLLM to align it with other semantic-level methods. Specifically, we set max__ew_se www.sseeeeeeeesseeeeeeee to (instead of a token count), which is applied consistently across all semantic-level baselines. We set max_trial trials s to the default value of 100 for SemStamp, k-SemStamp, and SimMark. For the embedding model, we use the fine-tuned all all-mpnet -base-2 (Reimers & Gurevych, 2019)² provided by Hou et al. (2024). We also employ the k-means centroid weights released by Hou et al. (2024), trained on the C4 (Raffel et al., 2020) and BookSum (Kryšciński al., 2021) datasets. For the backbone gener- ation models OPT-1.3B (Zhang et al., 2022)* and Mistral-7B-vO.1 (Jiang et al., 2023) we use the original Hugging Face versions ensure fair comparison with all other methods. All other hyper- parameters are kept at their default settings in the k-SemStamp implementation of MarkLLM. For all SWM experiments, we assume that sentence segmentation is consistent during both generation and detection, such that we evaluate only the intrinsic capability of the SWM method.
Stt.://uuuuSSSSttmpppeeeempp sbert
21

---

Published as a conference paper at ICLR 2026
SemStamp. For SemStamp (Hou et al., 2023), we use the authors' official implementation, setting temperature = 0.7, top_p = 0.95, and max level methods. We also use the fine-tuned embedding model and the original generation model to ensure fair comparison.
= 12 to match the other semantic-
SimMark. We the official implementation of SimMark (Dabiriaghdam & Wang, 2025) We adopt cosine distance with the recommended validity interval [0.68, 0.76]. Additionally, we use the recommended embedding model instructor large (Su et al., 2023)' and the original gener- ation models OPT-113B and Mistral-7B-vO.1 to maintain comparability with other methods. The factor K set to 250 for the soft-2 test, following the original paper.
PMARK. During generation, we use the original a all all-mpnet -eattt-aaeevv embedding model (Reimers Gurevych, 2019)* without fine-tuning. Pivot vectors are generated via QR de- composition of a Gaussian random matrix (Trefethen & Bau, 2022) to ensure orthogonality. We set temperature = 0.7, top-p = 0.95, and max_new.sennences = 12, consistent with other semantic-level methods. The sample budget is N = 64, and the number of channels is 6 = 4. For detection, we set the numerical threshold 5 = 0.001 and the smoothing factor = 150.
G.2 ADVERSARIAL ATTACKS
Doc-P. We conduct paraphrase attacks following the official SemStamp implementation Hou et al. (2023; 2024). Specifically, for the paraphrasers Pegasus (Pu al., 2023) and Parrot (Sadasivan et al., 2023)th, 10, we adopt the bigram-style attack proposed by SemStamp Hou et al. (2023), which selects paraphrases with minimal bigram overlap relative to the source. For the GPT (OpenAI, 2022) paraphrasing attack, we use the prompt provided by MarkLLM (Pan et al., 2024). All attacks are applied at the sentence level across all methods and settings simulate real-world scenarios.
Doc-T. We implement the fack-translation attack following MarkLLM. Specifically, we use Llama- 3.1-8B (Dubey al., 2024)" translate watermarked English sentences into Spanish and then back into English in attempt to remove watermark evidence. However, as noted in Section 5.2, this attack can be biased and unstable in some cases.
Word-D and Word-S. We implement word deletion (Word-D) and synonym substitution (Word-S) attacks following the official MarkLLM implementation. We set the attack ratios to 5%, 15%, and 30% evaluate the overall robustness of our method. Additional experimental results reported in Appendix H.
H SUPPLEMENTED EXPERIMENTAL RESULTS
H.1 ROBUSTNESS TO ADVERSARIAL ATTACKS
We evaluate the robustness of existing watermarking methods under various attacks, with results shown in Table and Table 6.
H.2 QUALITY OF WATERMARKED TEXT
Similar to Figure 3, we present additional results about the perplexity of cxisting methods across different benchmarks and backbones Figure 7, 8 and 9.
H.3
SENSITIVITY OF HYPERPARAMETER
We present additional hyperparameter analysis results for OPT-1.3B in Figure 10, where similar conclusions can be deduced.
H.4
CASE STUDY
We illustrate various cases of SemStamp and PMARK across different backbones and datasets. Com- pared with the baseline, PMARK demonstrates superior text quality and robustness, producing more diverse sentences and retaining watermark evidence even after paraphrase attacks.
22

---

Published as a conference paper at ICLR 2026
Algorithm 3: PMARK Offline Generation
Algorithm 4: PMARK Offline Detec-
Input: M; s.)) T::;;; ".),, R (ran)):
tion
N
Input: S == [=> [1(0) (0) ]: T: o
Output: (11) ,....-813)
R= (r h: 8; Kia
for +- to T do
Output: True False
for j f to b do
for j f to do
Fj(s) f (0(), T(s))
Define (5) (60)) T()))
end
end N₂ + 0; Nau + T
Umnx
f -0;; B + Ø for i f-111 1 to N
Sample (1) ~ Par(21 80.
for + 1 to T do
Sig(x!") + [z)( > >0], j=
for 1 to do
[(c.j) < (s mi)) + 0
( Sig(æ (i) if uf then
r(())))) = 1 and
F(t.)) m
6 then
continue
C(t.)) +
end
else if ((t.)) 0 and
if u
Mmax then
[(tt]) mm + then
Umax f u (
B t (x)
C(t.d) +
else
end
C(t,) +
else if u Umax then
expl K (a((.)) - m
B + BU 1)
end
end
Ng Ng c(c,))
end
end
Select (0 Un(
end
end
Ng 0.5 Nocal
return (2 > sa)
return
v0.25 Noval
Figure 6: PMARK Offline Watermarking: Left: Generation using fixed prior median Detection using soft z-test.
0; Right:
Table 5: Overall results for baseline methods and PMARK OPT-1.3B and Mistral-7B on BOOK- SUM. Doc-T denotes back-translate translatiiion attack by LLama-3.1 while Word-D and Word-S are word-level attacks under different ratios.
Metbal
No No.alack
Dao Sagasal
Dicmmi Depd HGPT)
Dic-
Wint-D
Wogg-DiL300
Wandsiiiei
WerdantiS
GFF-34
TNP 20033
SUERR ESE3
33012201
127330
3301-260
NOW GREZ
46.825
1403905.7
0.5423355
133.5083
L23 1026
L49.0914
1377590
141129929
SIK
52 22.9988/753
96667169977
DNORERUNTRLE
6
80 51
133/113118
150514067
060-7
SC-ALENS
WISTNASSLL
(105))
LSS
133-9533
S/11
07.658 166
57
Sasitak (155
88.294 E49 3
13 23442.9945
25240.44556
22.77187667
06-43 6970
SL82666967
91-30 AMACA
45 23
51 2199
10 15.71111111
11 17932
10.0 EARA
1992
9F 10P15
15 11
SYTHOLANEE
EXP 20G3 NOW (3803)
35 1.4000555
41281.8931
TRASS ETRA
2LA76 APRAS
54 14260.991
16207.399
DRATTBBET
UPV VTCCk)
TLATS TALL
10.00
MLSTIR BIIEE
SyablD (23-3
MarpMMak (HIC))
PAED00 DIESO
17
1185509955
92.591 2
97.288 486.5
07.1011366.
WUSSE
ST STW6:3886
53 44475/53
113500555
21945-30433
2440177777
3188419111
40 08.612293
04 (1100994
VC /04 1965
43 S/RLS
24 1V4 S79/4
04 (1AAI19
I BROADER IMPACTS AND LIMITATIONS
As a pioneering study on fistortion-free and robust semantic-level watermarking, PMARK paves the way for more secure and powerful solutions for copyright protection and content attribution in the Al industry. However, several limitations remain. (1) For simplicity, we consider only fixed random seeds in this work, although more flexible techniques such as sliding windows and pseudo- random error-correcting codes could enhance adaptability. (2) While the sampling-bai based generation paradigm avoids the sampling failures of prior methods and provides an indirect estimate of the next- sentence distribution- -thereby reducing distortion the required sampling budget still needs to be further reduced for practical deployment. (3) Current SWM methods, including PMARK, operate at the sentence level, which depends on consistent sentence segmentation between the generation and
23

---

Published as a conference paper at ICLR 2026
Table 6: Overall results for baseline methods and PMARK on OPT-1.3B and Mistral-7B on C4.
3713
PALEO
713
$18.1
76.9914988
$1,775 555
98,599L999.
MIK (36039
SLAND A6R
20ANSS 393
Kmaait (3134)
108 R11E APACC
GereFaung (3331)
64
1/8.3
$4.09933 3953
75.51 0930
SLANG D07T
ST.011 AN00
03 11N--5SLL
52 TETH ART
SarMakk (3855)
13
091 228.
116075 6874
13629-3811
856-4
C3 (AKG
UST DNET
8807 6911
25 T68-5415
30 DIGOANL
2L2944755
255.1
$3.359
51
55 178--774
SC 30
15 DOCCOO
KOW CEDTO
27 p8t 580
19280-288
6-375 1956
WURRLANSS
BLETTE 8969
UPY (30t0))
05.490207113
TL9914913
(323)
0120144922
MkaybMak (325))
1429914733
35.2933014
488
5-96
71
09 003311200
CAL-
STAPPANN
12
11.31:201
11:00 2014
536-
2785 50012
13301 N90-
64800-9972
01-901993
00AV5 2963
3130637969
25.349 1963
141/912945
04 1156639913
01 196.999
PPL vs. Doc-T TP@FP=1%
EXPGumbel
Ours(On) Ours
@FP=19 11%
90
MorphMark
EXP
yD
+ UPV
Doc-T TP TP@FP=T
K-SemStamp SemStamp
85
80
KGW
75
70
+ SIR
65
Sim Mark
8.0
7.5
7.0
6.5
6.0
5.5
5.0
4.5
PPL( better)
Figure 7: Mistral-7B PPL on BOOKSUM.
detection processes. Future research should explore more advanced SWM methods that eliminate this reliance and embed watermark evidence directly into the semantics of text, potentially enabling more sophisticated capabilities such as detecting whether specific ideas originate from LLMs.
24

---

Published as a conference paper at ICLR 2026
PPL vs. Doc-T TP@FP=1%
100
UPV
SynthID
Ours(On) + Ours(Off)
Doc-T TP@FP=1%
MorphManthsappm
80
+
KGW
SimMark
60
SIR
EXPGumbel
EXP
8.5
8.0
7.5
7.0
6.5
6.0
5.5
5.0
4.5
PPL(
better)
Figure 8: OPT-1.3B PPL on BOOKSUM.
PPL vs. Doc-T TP@FP=1%
100
+ KGW
SyntMiuPP
(un)(On)++
O
Doc-T TP@FP=19
SemStamp
K-SemStamp
MorphMark
60
40
20
EXP
SimMark
EXPGumbel
+
7.5
7.0
6.5
6.0
5.0
4.5
PPL(
better)
Figure 9: OPT-1.3B PPL on C4.
BOOKSUM
BOOKSUM (Attacked)
(Attacked)
100
99.8 100.0
99.4
99.8 100.0
99.4
99.8
100.0
99.4
TP@FP1%
98.1
97.8
98.0
97.2
98.0
98.2
96.0
95.4
95.4
95
94.22
94.2
94.4
92.4
92.6
93.0
90.6
90.8
89.5
150/0.0 Online
150/0.0 Offline
150/0.001 Online
150/0.001 Offline
250/0,001 Online
250/0,001 Offline
inf/0.0 Online
inf/0.0 Offline
Figure 10: Performance comparison of OPT-1.3B under different hyperparameter settings.
25

---

Published as a conference paper at ICLR 2026
Hegaetty Easid papars capart the
The diry
bigen ledd yourg from the day to the
Livad villte
endreer man commits suicie
rur
varry
10.
Fool te
From
shout
they Los wile is Naegani chertr...
Cavid and Peggeity ane inviied in and they all dt dovn to
0
She and Loved it's
Heggetyy been
wil by somel
Eigine so and Laveni the
maney
larger
dusking mir
bays includin the mecer eetovrry
waic
The
Oe read with the Joveicule yet anotbar auancla of
Cas te David Coppart ail Unown peiraaile FDN.
She teil
Steeforth and lete
Neggetyry joy diteer
Consertald young pos 1e. 188 by Shevil Coppart brreet
dereeeetenn Zpen co lee in shiinn.....
The cwl.oiiiii 7a has bus nen then...
(a) SemStamp without attack.
(b) Offline PMARK without attack.
(c) Online PMARK without attack.
Dives mucter this
and INls oreas
The
The mar ieserer sie of bellced whi on the and
Loved ineatiored thait to cuana to bencauta ta uiks
sur oucratala
binds
har othar
day,
grened i pette eingett schas. Lintt
Mult
auch ott Liette Sha boltdded
14a0 eear).
Dacid feol
avcret dired with by unetiig to soac and sted
David' Frunccal dificttie unard to and shog
is vls
in Sterrarth
Puggett
c/od Date
Board Copperkenl in
The reserrt ao anditen aatiiity
to Exvil
Devasitan bere. T0 Coenerior sarriing
Devid wdutterlly ceren sage beboee the
cardeed
(d) SemStamp paraphrased by GPT.(e) Online PMARK paraphrased by(l) Offline PMARK paraphrased by GPT.
GPT.
Cases from Mistral-7B on BOOKSUM dataset. o, ., o and indicate valid watermark evidence is detected with the transparetness denoting evidence strength, while e indicates that no valid evidence detected in this channel.
Figure 11:
Lassure depicy HAOW Sen WaOse THE Dar wos
Inn sol auee aver read pake AantLa ESA
antty
LiPiaa lopuu sits worls oftec Tatte FAT
Co Cellowes elctioe
Ling gated. FANcSooett adta af deieett Boyll
They men sot par
you
daatmed that Shan
great
cool
not pertect.
agai
They went through times Phey sever gave
ran besk data account hi
teat strne candicts Lebourn
sedely and sxppared
beark
(a) SemStamp without attack.
(b) Offline PMARK without attack.
(c) Online PMARK without attack.
Desordar the these Fane hast mn a
secved
ring NiC
is connitted
Hember
of spentigiin Re bruttve Welt acinp
contanvesiee cukoad tnd tarel wita anreett....
Sheir the
lutt legid
thane
orficied tenryy vitl Degar hisl caree Lakea cound lor Vesi
The prosiins wnd Labo Nira Hirarse aooil scp oaie
la cocler polic inseigation ongging of
cloed.
frest inln and their and never but
tean agei
0
upa
as fode saniing coniiberrs
Shast mar an oor and th petor
staing not
morking an over b
litell that crsctted
an inspoee pato
more just sos eng and nora
fovert
Hisdess and
my
(d) SemStamp paraphrased by GPT.(e) Online PMARK paraphrased by(l) Offline PMARK paraphrased by GPT.
GPT.
Figure 12: Cases from Mistral-7B on C4 dataset.
26

---

Published as a conference paper at ICLR 2026
contared bell
shom.
chapprr
to
UK
Ho dis thove latter and tis latter
The secced 18 Marth 2014
mortt.
Che andivation Edhunny la to that cherge
paint
Cogar devemined book about
Durling poree the das lawe cerloc sorver what afe gredeetteer Arm Belim.
and bubelo dakig yar
(a) SemStamp without attack. (b) Offline PMARK without attack.
(c) Online PMARK without attack.
greveyirs
chapper and
The aidd conte the July S. 2013
upcoiiing caapier and go to
Tha ming
Oiglind Wi sour
Erdling
chapter
2013
De talp
di
chicter VA uiee from Aathor" Cogar onfire
The slow wax contireed fora secors search Septerber
als
enter
rederrcatss by
secced
dobut
sn liter lo lim.
an sokurbbers aaas Edies''s the
Edger
talc about
teaoelirs passing a din Aigifiuett event the story.
The inturt Hunry pnscaned Aano derdeotres
(ICind baliig Harty Chathart
Expar Reed will to booe 6R.0
(d) SemStamp paraphrased(e) Online PMARK paraphrased by(() Offline PMARK paraphrased by GPT.
by GPT.
GPT.
Figure 13: Cases from OPT-1.3B on BOOKSUM dataset.
minerki and cornect iserrcs dars
search paga ny
keda rignr loai Thee lsee lo Partable
The conpeny been tarting thes festure while rcw.
The new festum veloons acdit fut to the
thit sricee caick your comuiity witciiig
ank Clude 20 sac3in
0
You TV, sup
the
Golgle caloo ty
to the
brin
videe shremingg muth
The
apatriingg sactinn
Coogley
Acsoriing to Cooqu the company byy 20 191
Arter
(ilh Google suace ads you cwes
0000
sel incuude What di wotch
thet shoce guick
anati mect
pee to of
the compeny try 50 1ge
ande
Oveg
pay parto
wattiing secion that rep wit yndr cortrally siiicii
hartinurs and
(a) SemStamp without attack.
(b) Offinee PMARK without attack.
(c) Online PMARK without attack.
rrall ing reu to servicas Seeper live.
cau accuss teery by soddnng Wanch switt
engigee
fram
Caneda
urongg gran
this for
The ranr revert Dammentt DC Teadi
Google sostas that new sary ca yorr ann yy
gaal to pou
pef/os, Fite whin offer se
this Google
amanning
Google de test line Tee
ting servic TV
cact lipheps br of the conta and
and
Googles to mostaaeiiy
pfowyy
The new seuent festir a "camrityy wanciing 19*
2h.b la curerdl accusti cocaillei Unite Stuns and prepared
hawe the option cheese
advetberwen
noriiee picce Tel enolures
company
servir cilect eriee the sunch deta
tou tav
welchee wather
crrwer.
por
chatess
The coeert Heata dily wapoo mf
The pou serves uil au baed hardiem and aotivars
Googles searc aid and you lo play a vodiy in
(d) SemStamp paraphrased by GPT.(e) Online PMARK paraphrased by(l) Offline PMARK paraphrased by
GPT.
GPT.
Figure 14: Cases from OPT-1.3B on C4 dataset.
27


Reviews:
[{"review_id": "lBhjYVMB8k", "reviewer": "Reviewer_zq8u", "summary": "The paper first introduces a new theoretical framework on semantic-level watermarking with the concept of proxy functions, which covers existing methods.\nIt points out that they are not robust to attacks due to distribution distortions.\nBuilding on the framework, they propose PMark, which is distortion-free.\nThe experiments show that PMark improves the robustness against paraphrasing-style attacks and also outperforms in text quality.", "questions": "* (It is an open question and not related to the assessment.) Are there any insights on how the method would work (or not) if we do cross-sentence paraphrasing attacks (e.g., there will be sentence deletion, merging, etc). \n\n-- Will the smooth counting mechanism and the soft-count-based z-test help?\n\n-- Why do you focus on the sentence-level instead of the n-gram chunk? The former may have a large uncertainty in each sentence's length. Maybe if a sentence only contains 2 words but has 1 word removed in attack, the sentence-level semantics will shift a lot.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "* The paper's theoretical framework is accurate and clear. It is very important for the community to systematically understand the literature and the limitations of the current stage.\n\n* The experiments are comprehensive, and the settings are timely and accurate.\n\n* The presentation of the paper is clear and fluent.\n\n* From my knowledge, this is the first distortion-free semantic watermark paper.", "weaknesses": "* (a minor point) Some symbols look overlapped but with different meanings. I am unsure if there is any way to prevent it. For example, $m$ denotes the size of the green list in Theorem 2; $m_v$ denotes the median of $F$ later in L213. There might be a chance the readers build a connection between, but indeed they should not.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lsYsquqBaR", "reviewer": "Reviewer_4inb", "summary": "The paper introduces PMARK, a semantic-level watermarking method that aims to be both distortion-free and robust to paraphrasing. The core abstraction is a proxy function that maps a sentence to a scalar. PMARK employs rejection sampling on median-based half-partitioning of semantic space along several orthogonal channels. The authors prove distortion-freeness and demonstrate improved semantic robustness across different benchmarks.", "questions": "1. Can you provide an end‑to‑end evaluation where the detector does not query the generator (unknown M and prompts), using the offline variant?\n2. Is there formal guarantees for the offline method?\n3. How does PMARK work when an attacker obfuscates sentence segmentation, such as randomly changing all periods to commas?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proxy function formalization and closed‑form distortion analysis clarify why split‑and‑reject SWMs distort and motivate a median-split alternative; the multi‑channel constraint is a simple, elegant idea that increases evidence density.\n2. Strong results across two backbones, two datasets, many attacks, and against several prior methods; PMARK‑Online exceeds prior SWM baselines by large margins.", "weaknesses": "1. This work assumes the private key is drawn from a prior distribution. If the prior key is hashed from the context, the semantic robustness would break since the random seeds can't be recovered.\n2. Multi-channel sampling introduces additional computation overhead and seems inherently incompatible with batch decoding.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hEbkaTF8Z4", "reviewer": "Reviewer_SZC6", "summary": "This paper presents a unified theoretical framework for semantic-level watermarking (SWM) in natural text generation and introduces **PMARK**, a well-founded and practical method that is provably distortion-free and robust. As research on SWM remains nascent, partly due to limited theoretical guidance [1], this work could help pave the way for subsequent advances, even though several limitations warrant further study.\n\n[1] Zhao, et al. Sok: Watermarking for ai-generated content. 2025 IEEE S&P.", "questions": "1. Although the authors claim that random seed generation for SWM is challenging and that prior approaches may not be suitable, could the authors suggest a possible solution or research direction for this problem?\n    \n2. As noted in the Weaknesses, could the authors provide a theoretical analysis of the adversarial robustness of multi-channel sampling?\n    \n3. (Minor) The annotations in Figure 4 are relatively small.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Clean and solid theoretical analysis. The paper unifies prior work such as SemStamp, k-SemStamp, and SimMark under a proxy-function framework and presents a **provably distortion-free multi-channel** sampling rule furthermore.\n    \n2. Novel paradigm. This is the first distortion-free SWM method, whose robustness is enhanced by multi-channel constraints. The ideas in this work is elegant and effective, and may help deepen our understanding of semantic-level text watermarking.\n    \n3. Solid experiments. The experiments are solid, confirming the generation quality and robustness of PMARK. The ablation study is detailed and convincing.\n    \n4. Good writing and presentation. The paper is well organized and easy to follow; the figures and charts are clear, aside from a few minor issues (see Questions).", "weaknesses": "1. Theoretical analysis of multi-channel robustness. Although Eq. 11 characterizes the robustness of single-sentence watermarking, could the authors provide a more detailed theoretical analysis of **multi-channel** sampling under common conditions?\n    \n2. Discussion of token-level related work. Some token-level watermarks [2,3] use scoring functions during sampling as well. Including these works in the discussion would help contextualize the relationship to SWM.\n    \n3. There are also some limitations discussed in the paper including the analysis of offline method and the extension to n-shot undetectable SWM, which are leaved for future works by authors. Could the authors denote some possible directions for subsequent improvement?\n    \n\n[2] Giboulot, E. and Furon, T., 2024. WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off. NeurIPS 2024.\n\n[3] Bahri, D. and Wieting, J., 2024. A watermark for black-box language models. arXiv preprint arXiv:2410.02099.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UMRrgRIQPC", "reviewer": "Reviewer_dwYt", "summary": "PMARK is a semantic-level watermarking on a new Proxy Function (PF) framework: a PF maps sentences to scalars, enabling distortion-free sampling and detection. The method extends single-channel median sampling to a multi-channel scheme to improve the robustness against modification and paraphrasing.", "questions": "More analysis on the dependence of PF on the encoder. \n\nMore guidance on the hyperparameter settings from the theory to practical deployment.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The idea of using multi-channel to constrain the watermark to enhance the evidence is interesting.\n\n2. The theoretical results seem solid.\n\n3. Experimental results show superior performance over prior works.", "weaknesses": "1. Error bar is not presented for the main results. Some values are too close to those of prior works to claim the best. \n\n2. Online and offline versions should be better considered as part of a general workflow and not require the user to make a decision.\n\n3. Even though authors tried to solve the problem of watermarking short texts, which should be harder for this method, the requirements of computational resources, as well as time complexity, will be a problem.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)