An Ensemble Framework for Unbiased Language Model Watermarking
Authors: Yihan Wu
Ruibo Chen
Georgios Milis
Heng Huang
Venue: ICLR 2026 Poster (2026)
Keywords: LLM watermarking
Primary area: generative models

Abstract: As large language models become increasingly capable and widely deployed, verifying the provenance of machine-generated content is critical to ensuring trust, safety, and accountability. Watermarking techniques have emerged as a promising solution by embedding imperceptible statistical signals into the generation process. Among them, unbiased watermarking is particularly attractive due to its theoretical guarantee of preserving the language model's output distribution, thereby avoiding degradation in fluency or detectability through distributional shifts. However, existing unbiased watermarking schemes often suffer from weak detection power and limited robustness, especially under short text lengths or distributional perturbations. In this work, we propose ENS, a novel ensemble framework that enhances the detectability and robustness of logits-based unbiased watermarks while strictly preserving their unbiasedness. ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal. We theoretically prove that the ensemble construction remains unbiased in expectation and demonstrate how it improves the signal-to-noise ratio for statistical detectors. Empirical evaluations on multiple LLM families show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks without compromising generation quality.

Published as a conference paper at ICLR 2026
AN ENSEMBLE FRAMEWORK FOR UNBIASED LAN- GUAGE MODEL WATERMARKING
Yihan Wut, Ruibo Chen", Georgios Milis, Heng Huang Department of Computer Science University of Maryland, College Park {ywu42, rbchen, milis, heng) @umd.edu
ABSTRACT
As large language models (LLMs) become increasingly capable and widely de- ployed, verifying the provenance of machine- senciine-enerated content is critical to en- suring trust, safety, and accountability. Watermarking techniques have emerged promising solution by embedding imperceptible statistical signals into the generation process. Among them, unbiased watermarking is particularly attractive due to its theoretical guarantee of preserving the language model's 's output distribu- tion, thereby avoiding degradation in fluency or detectability through distributional shifts. However, existing unbiased watermarking schemes often suffer from weak detection power and limited robustness, especially under short text lengths or distri- butional perturbations. In this work, we propose ENS, novel ensemble framework that enhances the detectability and robustness of logits- bbated unbiased watermarks while strictly preserving their unbiasedness. ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal. We theoretically prove that the ensemble construction remains unbiased in expectation and demonstrate how it improves the signal-to -ooiiee ratio for statistical detectors. Empirical evaluations on multiple LLM families show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks without compromising generation quality.
INTRODUCTION
The rapid progress of LLMs has enabled them to generate human-level text scale, raising urgent questions about provenance, accountability, and misuse of Al-generated content. A leading line of defence is watermarking, which embeds hidden statistical signals into the generation process
so that downstream detectors can later verify authorship with high confidence (Aaronson, 2022
Kirchenbauer al. 2023 Christ et al. 2023 Kuditipudi et al. [2023] Hu et al. 2023 Wu et al. 2023
Chen et al. 2024a Liu & Bu 2024 Chen et al. 2025 Mao et al. (0222] Dathathri et al. 2024).
Ideally, watermark should satisfy three properties: (i) imperceptibillty; it should leave fluency and
semantics intact; (ii) detectability: it should be reliably identified from a moderate amount of text;
and (iii) robustness: it should withstand natural corruptions and adversarial removal attempts.
Among these methods, a particularly important subclass is unbiased Ka.k.a. distortion free)))--reeeeooo- water- marking (Aaronson] 2022 Christ al. 2023 Kuditipudi al. 2023) Hu et al. 2023 Wu al..
2023. Chen et al. 20255 Mao et al.) 2024| Dathathri et al., 2024). which modifies the generation distribution in a way that preserves its expectation. In other words, the average output distribution of watermarked model remains indistinguishable from the original model, ensuring that watermarking does not degrade text quality or introduce detectable artifacts. This property makes unbiased water- marking especially attractive for real-world deployment, where imperceptibility and content fidelity are critical.
* "qqual contributions
This work was partially supported by NSF IIS 2347592, 2348169,, DBI 2405416, CCF 2348306,, CNS 2347617, RISE 2536663.

---

Published as a conference paper at ICLR 2026
However, unbiased watermarking faces key limitations in practice. Because the expected distribution is unchanged, the statistical signal available to the detector is inherently weak. This often requires longer token sequences for detection and leaves the watermark more vulnerable to attacks such as sampling smoothing, truncation, or paraphrasing. To address these challenges, we propose ENS, an ensemble framework that composes multiple unbiased watermark instances with independent keys to amplify the detection signal while provably preserving the LM distribution. Intuitively, each watermark layer makes a tiny, unbiased perturbation; stacking n such layers aggregates the bias under the detector's s statistic, boosting -egal-to-noise ratio roughly by vn while keeping generation quality intact.
Our main contributions are summarized as follows:
We introduce ENS, a general ensemble framework for unbiased watermarking. Our method sequentially applies multiple independent unbiased reweighting functions. using distinct keys, to enhance the detection signal without altering the expected distribution.
We prove that ENS remains unbiased in expectation under independent keys, and we analyze how the ensemble size affects the watermark's 's detectability and robustness.
We empirically demonstrate that ENS significantly improves detection performance and robustness to common perturbations across multiple model families and watermarking baselines, while preserving generation quality.
2 RELATED WORK
Kirchenbauer et al. (023) refined the statistical watermarking framework initially introduced by
Aaronson 2022). They divided the language model tokens into red and green lists and favored the green list tokens by adjusting their logits with fixed increment 5. However, the proposed approach can inevitably decrease the generation quality of the text. To maintain the original output distribution in watermarked content, researchers have investigated novel approaches for token distri- bution modification. There are generally two types of unbiased watermark: sampling based unbiased watermark and logits based unbiased watermark. For sampling based unbiased watermark, the ggeudo-random token sampler to sample the next token. For logits based unbiased watermark, we adapt aseudo-random adjuster to modify the LM token logits, then sampling the next token based the modified LM logits.
Sampling based unbiased watermarks. Aaronson method using Gumbel-max to pseudo-randomly sample the next token with prefix n-grams as watermark keys. Christ al. (2023) used inverse sampling as the watermark sampler on binary language model with watermark keys based on token positioning. ITSS-edit and EXP-edit Kuditipudi al. (2023) refined the inverse- saverse-sampling and Gumbel-max strategies with a predetermined watermark key list. Hu et al. (2023) used unverse-samplic and design a model-based LLR score for detection. STA-1 Mao et al. (2024) adapted ajjectdd-sampling strategy to improve the quality of the watermarked text under the low-entropy scenarios. Dathathri et al. (2024) proposed SynthlI), which used multi-
2022
pioneered an unbiased watermarking
layer tournament sampling to achieved better detectability.
Logits based unbiased watermarks. Hu et al. (2023) introduced the first logits based unbiased watermark, 7-reweight, for watermarking, though their detection method not model-agnostic. DiPmark Wu et al. (2023) enhanced the y-reweight technique and introduced model-agnostic detector, Chen et al. 2025 presented MCmark, which significantly improved the detectability of the unbiased watermark.
PRELIMINARIES
Notation. We follow the notation conventions from prior work (Hu et al. 2023 Wu et al. 2023
Mao et al. 2024 Chen et al. 2025) to describe the language model generation process. Let V denote the vocabulary set with cardinality = |V]. Define V as the set of all possible token sequences of any length (including the empty sequence). Given prompt, the LM generates tokens autoregressively. The probability of generating the next token Iz+1 E V, conditioned on the preceding sequence
Ti, "1, Ftt, denoted by Pas ( #1:+) E P, where P represents the space of token distributions.
2

---

Published as a conference paper at ICLR 2026
Watermark Generator. To embed watermarks, the service provider modifies the original LM dis- tribution PM using either sampling-basee basedd or logits- based watermarking methods. The watermarking process involves reweighting (- (1:e) to watermarked distribution PM. Ti:e, k), where k E IC is a private key sampled from a known key space distribution Px(k). In practice, this key is typically derived from hash function h applied secret key sk and context identifier (e.g., an n-gram (Aaronson 2022) or token position (Christ et al.) (023)).
Logits-Based Reweighting. In logits-based watermarking, the watermark generator applies reweighting strategy F' F PxK. + P. which transforms the original LM distribution Par( x1:)) into watermarked distribution F(P F(PM(( x1a), Following (Hu et al. 2023), a reweighting function F said to be unbiased if it preserves the original distribution in expectation over the key space. Specifically, for any Pas E P and 1441 EV,
ER~Pe [F(Pa((Te41 æ)..), = Par ( T1:)).
Watermark Detector. At inference time, the detector receives: (i) the generated text sequence F1:T, (ii) the watermark keys (or a means to regenerate them), and (iii) the public description of F. Detection is framed as a binary hypothesis testing problem: Hy: The sequence was generated without a watermark; H1: The sequence was generated with a watermark. The detector constructs a statistical score function based on k and F, which exhibits different distributions under Ho and H1. Under H1, the statistic is stochastically larger (or smaller) than under Ho, enabling detection with controlled type-I error. This allows for distinguishing between watermarked and non- watermarked content using standard hypothesis testing techniques.
METHODOLOGY
In this section, we introduce an ensemble framework for logits- unbiased watermarks, aiming to improve both detection reliability and robustness without sacrificing unbiasedness. We propose an ensemble construction that composes any base logits-based based unbiased watermarking rule F with multiple independently drawn watermark keys. Intuitively, each application of F injects an (unbiased) weak statistical signal aligned with its key; composing n such transforms stacks n weak signals. Because unbiasedness defined in expectation over the key distribution, sequential composition preserves marginal unbiasedness to the underlying LM distribution when keys are independent. At detection time, we exploit the availability of all n watermark keys aggregate evidence across them, yielding improved statistical power at the same (or controlled) false positive rate (FPR). This section formalizes the construction, proves unbiasedness, develops score aggregation and significance testing procedures, and discusses practical design choices (key scheduling, context partitioning, computational cost, and robustness considerations).
Definition 4.1 (Watermark ensemble). Given an original LM distribution PM E P, a logits- based reweight strategy F F, and n watermark keys ki.n define the n-fold ensemble transform ENS: N x P x F
x > +P recursively,
F FENS(( - 1, PM((( k)m-)),
1;
ENS(n, F, Pas (-11) kLn)
(2)
n
For brevity we suppress the conditioning context æia when unambiguous and write EN
The ensemble mechanism can be viewed as multi-layer reweighting pipeline, where each layer applies a subtle perturbation governed by its corresponding key. The resulting distribution remains close PMr in total variation, but the watermark signal accumulates across layers, enhancing the detectability of the watermark. The detailed watermarking algorithm can be found in Algs. [ and 2
Sequential vs. parallel views. The recursive definition is sequential: each new key reweights the
distribution output by the previous step. An equivalent parallel interpretation, which is useful for certain implementations, treats the final logits logits before reweighting. Sequential and parallel forms are algebraically equivalent for common families of F (e.g., additive logit shifts, multiplicative temperature scaling within greenlists).
of per-key adjustments applied to the original
3

---

Published as a conference paper at ICLR 2026
4.1 UNBIASEDNESS OF THE ENSEMBLE
A crucial property of unbiased watermarking is the preservation of the original distribution's expecta- tion over random keys. We show that this property holds under our ensemble construction: Theorem 4.2 (Unbiasedness). If F is an unbiased logits- baats- reweight strategy, and the watermark keys kin i..dd from Pk. then the n-ensemble of F is also unbiased based reweight strategy, i.e.
ER C PR (EM( (Par((a = PM x0::))
holds for arbitrary Psa(-(21:) E.P
Proof sketch. We argue by induction on n. The base case (n=1) reduces to Eq. Suppose Eq. holds for n- For n., condition on the first n- keys and apply the law of iterated expectation:
3
E km. ENS,, (PM
E B Es, F
k=)(o)]
(4)
(
E [ENS, 1 (Par (+1aa:))))
PM (vlare))
(5)
where is arbitrary token in V. (a) applies Eq. | with P = IN)) (valid because F is unbiased for any input distribution), and (b) uses the induction hypothesis.
Remarks. (i) Independence is sufficient but not necessary: certain correlated key schedules also preserve unbiasedness if the marginal over the final key k, is uniform and F obeys a linearity property. (ii) If F's unbiasedness holds only approximately (e.g., due to numerical truncation or top-K filtering), ensemble bias accumulates at most linearly in n.
Watermark key design. The unbiasedness of ENS, requires that the watermark keys be inde- pendent during single generation step. Recall that a watermark key 1 is typically derived as h(sk, graam)), where h is hash function ensuring independence across different (sk, n-gram) pairs. Following this principle, there are two ways to generate independent keys for ensem- ble watermarking: a) Use n distinct hash functions hi..... lins so that in each generation step, h1 (sk, n-gram)..... hn (sk, n-gram) are independent. b) Use distinct secret keys skı,... sk,, so that h(sk,, n-gram), fsk,,, n-gram) remain independent. In our implementation, we use b) to ensure the independence of the watermark keys during generation.
4.2 DETECTION EFFICIENCY
The detection of the ensemble watermark is straightforward. If the ensemble is built upon a logit- based strategy F, we can simply apply the detection algorithm of F times using the secret keys (ski,..., Sk,), and then aggregate the resulting detection scores.
Detection with Ensemble Watermarks. Given generated sequence F1:7, detector score function S, and secret keys (Ski,... Sk,). the detector computes per-key scores [S(#1. sk;) } and aggregates them, e-g. SENS(#I1:))
Ex= S(11:T, sk;). Because the watermark bias adds coherently across independent keys, SENS enjoys higher signal-to-nois -oisee ratio, enabling stronger hypothesis testing between Hy (unwatermarked) and H1 (watermarked).
Signal and Variance Behavior. Unbiasedness ensures that, a downstream observer without keys cannot distinguish (N),, from P. Detection instead leverages conditional shifts introduced by each key. Let (k,,,skk denote the pok-token score computed by the detector when evaluated with secret key sk,. Under the alternative hypothesis H₃ (watermarked with the same keys), the statistic Sk) has mean shifted by a positive amount μ4; >> O relative to its mean under the null hypothesis Ho (no watermark). The ensemble detector aggregates the shift across keys by combining either (a) raw per-key likelikelihood ratios, (b) standardized z-scores, (c) con-aaraettric ranks.
Because generation uses all n keys, the expected per-token shift in (T sk;) generally increases with n, but its variance also grows due to interactions among keys. For many logit-based reweighting F of interest (greenlist reweighting (Kirchenbauer et al., 2023); DiP-style sermute-reweiglee (Wu et al. 2023)). the per-key signals add approximately linearly small n, yielding signal-to signal-to-noise ratio (SNR) that scales roughly as /n for the aggregated statistic. We formalize one such regime below.
4

---

Published as a conference paper at ICLR 2026
Proposition 4.3 (Approximate SNR scaling). Assume (i) conditional independence of per-key centered scores given the underlying token, (ii) common per-key variance o², and (ii) common mean shift μ under H1. Then the sum statistic (INT( = =>i= S( sk,) has mean nu and variance no² under H1, yielding SNR(SENS) pyn/a. Under Ho. 'I' has mean 0 and variance nog. Hence, for fixed FPR calibrated under Ho, power increases with n.
Example (DiPmark detector). We illustrate the improved detecting strength of ensemble water- marking using the DiPmark detector. In the DiPmark detector, the red-green lists for generating each token reconstructed using the secret key and the corresponding n-gram. The detector then counts the total number of green tokens in the sequence and applies statistical test to determine watermark presence.
For given key sk;, let Va (11:2; sk;) denote the number of tokens in the sequence F1.T that fall into the green set induced by sk,. The DiPmark score
SDIP ( sk,) = VG(#1T: 0.5.
T
Under the Ho (unwatermarked text), the green indicators are i..d. Bernoulli(1/2), so by Hoeffding's inequality the (one-sided) p- p-value is bounded by Psingle I exp(-22 STIP (2 )).
Ensembling DiPmark detectors: Given keys ski..... skn, define the ensemble score
E Vo(xi.r;sk)
SENs(x1:1)
Σ
SDIP(a1.1. sk.)
n 2
T
i=1
Equivalently, writing Zi E 10 for the green indicator of token t under key sk, we have SENS( = n wT E E Z,, - 1)) Assuming independence across and under the
null. Hoeffding's inequality applied the average over nT bounded variables yields
2T 5²
PENS S exp (
27 SENS(x11:))
PENS = PI(SENS 2 s) S exp
In the special case where all single-key scores are equal, SDIP(WI:T ski) = SpiP skn) so, have SENS nsg and hence
PENS expl 2In s)) = [exp( 2T s6) n
(Psingle)".
Thus, ensembling independent DiPmark detectors improves the exponent linearly in n, i.e., the p-value decays exponentially with n. In practice, the ensemble p-value need not decay exponentially n, because the per-key DiPmark detectors can become less informative when used jointly (e-g.. due to the attenuation of individual scores). Nevertheless, ensembling typically improves overall detection power (efficiency) and yields a smaller p-value than any single detector.
Dealing with Key Dependence. In practice keys may not be statistically independent across tokens because the keying function hisk, c) often reuses fixed secret sk with context derived from overlapping n-grams positions. Overlapping contexts induce correlations in the green/boosted sets across ensemble members, which in turn correlate the per-key scores. To address repeated contexts follow (Hu al. (023)) and maintain history previously seen contexts during watermark generation; if the current already appears in the history, we bypass watermarking and sample from the original (unwatermarked) distribution.
4.3 EFFECT OF THE ENSEMBLE SIZE DETECTABILITY.
Increasing the ensemble size n can strengthen detection by aggregating signal across keys, yielding (under standard independence assumptions) an exponentially decaying p-value in n. Denoted by the portion of tokens promoted by the reweight algorithm, and the strength of promotion added on the logit. For reweightng schemes that promote a per-key green subset of size v/V], the intersection of promoted sets shrinks y V), reducing the chance that any promoted token lies in the model's 's high- piobbbbbbbyyltty region, which makes the per-key effect attenuates and detectability saturates even degrades.
5

---

Published as a conference paper at ICLR 2026
Table 1: Detectability comparison of different watermarking methods under 250- and 500-token settings. We report True Positive Rates (TPR) at fixed False Positive Rates (FPR) of 0.1 11,, 0.01% 10%, and 0.001 %, along with the median p-values (lower is better).
Watermarking Methods
250 tokens
500 tokens
TPR @FPP
Median p-value*
TPR@FPR
Median
p-value
0.1%1
0.01 %6
0.001%
0.1%
0.01%
0.001
DiPnark((==033)
41.48%
32.22%
23.28%
4.48e-3
71.84%
61.68%
50.50%
8.60e-6
LNS-DiPmark(o=0.331 n=
75.05%
66.77%
58.79%
9.77c-7
96.30%
91.51%
86.62%
3.28c-14
ENS-DiPmark INS-DiPmark(==03311 n=
74.49%
63.21%
58.18%
2.49e-6
93.33%
87.51 %
82.56%
3.75e-14
DiPnark((=00.)
49.90%
39.18%
31.86%
1.20e-3
80.48%
70.94%
62.17%
1.27e-7
4NS-Dipmarkca=0AA. n=5)
74.74%
67.15%
58.52%
5.36e-7
94.18%
90.23%
85.29%
9.19e-15
2NS-DiPuarKo=044,.as n=10)
70.58%
58.74%
51.23%
8.19e-6
91.75%
85.99%
79.59%
1.19e-12
7-reweight
52.00%
42.02%
33.99%
7.47e-4
81.26%
72.45%
65.16%
4.58c-8
ENS-r-roweigh((n=55)
73,98%
64.14% 14%
54.92%
2.04c-6
94.12%
88.58%
83.59%
4.81e-15
ENS ENS---reweiggh(===1))
65.81%
55,54%
48.56%
1.75e-5
88.97%
83.35%
76.97%
2.07e-11
SynthiD(m=20)
93.92%
88.55%
81.9%%
6.04e-12 12
99.68%
98. 60.6
97. 97.64%
2. 83e-26
SymthID(m=30)
93.83%
88.36%
83.50%
1.91e-12 12
99.24%
98.37%
97. 07.50%
4.07e-28
SymthID(m=00)
92.12%
87.58%
82.42%
4.79e-12
99. 29.24%%
97.84%
96. 11%
7.70e-28
MCMark(==20)
94.36%
90.37%
86.07%
4.18e-13
99.34%
98. 48.455%
01.01%
8.30e-26
FNS-MCMark((=20, w=3)
95.70%
91.71% %
87. 9..3%%
1.43e-14
99.89 %
99.57 %
98.59 %
2.58e-31
ENS-MCMur((=20, n=
95.15%
91.44%
85.88%
4.27c-14
99.12%
98.90%
98.02%
1.27e-35
Let |V| be the vocabulary size. For secret key sk,, let G, C. [[]]] be the green with |G,]
V (0 <> < Under an intersection-ats -tteeeerannnonnnn scheme, promotions apply G(n) n Gū, E[IG ss v' Let p(-) denote the pre-boost next-token distribution at step, and define the promoted mass M, Eveatn) p(v).
and each token lies in G(n) with probability y", we have [[M,] yn If logit boost of size < 1/> (if >> 1/7,, then the sum of the boosted probability will be greater than 1) applied each promoted token during each logit-based reweighting, the per-step shift in DiPmark-style score satisfies ((n) R e"E[Mr]] (ey)*.
Since E.P()
Aggregation gain sparsity loss. Let S; be the per-key detector score and SENS Under standard independence assumptions and boundedness of scores, Hoeffding//hermmn bound yields (2 S exp( CTnu(nn2)
Σi i-1 S.
exp CTTT(e))2)) for some constant C and sequence length T. This expression makes the off explicit:
2
n
vs.
aggregation guin
promotion spansity
Define g(n) == n (ETy)2 Then (n) increases only up to n² 2 21og[1/ey] and decreases thereafter. Consequently, PENS typically decreases with n for n* (improving detectability), but stalls and can effectively worsen for n > n² as the promoted mass E[M,] =n becomes vanishingly small (in the extreme, >"|
token is promoted at many steps).
Design implication. In practice, choose a moderate ensemble size n so that n RJ n²", For instance, if y 0.5, 1.8, then n² x 1/(2 ((looo1//00)) under strict intersection. Larger can be viable only if the ensemble design avoids strict intersection (e.g., by aggregating per-key logits or statisties) so that the per-key effect size μ does not collapse with n.
4.75, suggesting n (4, 5) near optimal
5 EXPERIMENTS
Our experiments comprise three main parts. First, we evaluate the detectability gains our ensemble watermark by comparing it with other unbiased watermarking methods text generation task. Second, we assess robustness under random token modifications, DIPPER paraphrasing attacks (Kr) ishna al. 2023). GPT paraphrasing attacks and GPT back translation attacks. Finally, we verify

---

Published as a conference paper at ICLR 2026
Table 2: Robustness comparison under paraphrasing attacks using GPT-40-mini and DIPPER.
GPT-4o-mini paraphrase
DIPPER
Watermarking
Methods
TPR @ FPR
Median p-valuel
@
Median
0.1%t
0.01%t
0.001 %
0.1%t
0.01 %t
0.001%
p-value
ENS-DiPmark(c=0.33 n=
8.41%
5.14%
2.80%
3.15e-1
3.26%
1.09%
0.00%
2.61e-1
005 n=5)
7.11%
3.56%
3.56%
2.13e-1
4.38%
1.03%
0.77%
3,55c-1
ENS----eweighhn==5)
6.73%
3,59%
3.14%
2.78e-1
3.05%
1.39%
0.83%
3.97e-1
SynthID(m==30)
25.39%
13.47%
6.74%
1.72e-2
21.58%
11.05%
7.11%
2.06e-2
FNS-MCMark((=20, n=3)
40.00%
29.44%
20.56%
3.69e-3
40.35%
30.70% %
22.22
5.09e-3
Table 3: Robustness comparison under GPT-4o-mini back translation Fenglish-Frenchh attacks using GPT-4o-mini and 10% random token replacement.
Back translation (En-Fr)
10% Rundom token replacement
Watermarking Methods
TPR @ FPR
Median p-valuel
@PR@FPR
Median
0.1%t
0.01%t
0.001 %
0,1%t
0.01%
0.001%
p-value
LNS-DiPmark(c-d)) nm5)
38.74%
26.31%
18.74%
4.61e:3
38. 38.74%
26.31%
18.74%
4.61e-3
(MS-DiPmark((=00.44 n=5)
44.38%
29.83%
20.99%
2.35e-3
44.38%
29.83%
20.99%
2.35e-3
ENS-7-toweight((==5)
41.71%
28. 88%86%
21.42%
3,53e-3
41.71%
28.86%
21.42%
3.53e-3
SynthID(m=30)
75.69%
64.53%
55.58%
3.16e-6
75.69%
64.53%
55.58%
3.16e-6
FNS-MCMark(1=20, n=3)
84.17%
76.43%
68.53%
1.94e-8
84.17%
76.43%
68.53%
1.94e-8
the unbiasedness of our method by showing that its output quality on machine translation and text summarization tasks closely matches that of the unwatermarked baseline. All experiments con- ducted on NVIDIA A6000 GPUs. All watermarking algorithms introduced negligible computation cost during LLM generation process. Detailed experimental settings are provided in Appendix D
Baselines. We evaluate our method against several baselines, including three logit-based unbi- ased watermarking algorithms: 7-reweight (Hu et al. 2023). DiPmark (Wu et al. (023)). and MC- mark (Chen al. 2025), as well as one sampling- et al. 2024). While other sampling-base
unbiased watermarking algorithm (Dathathri unbiased methods such as I'TS-edit (Kuditipudi et al. (222))
and STA-T (Mao et al., 2024) exist, prior work (Chen et al. (025) has shown that they perform worse than MCmark, and therefore we omit them from our experiments.
Models and Datasets. We employ Llama-3 3.2--3-------tteeee (Dubey et al. 2024). Mistral-77 Mistral-7B-Insteee Instrrtt v0.3 (Jiang et al., 2023), and assess the effectiivnness of our proposed ENS. Following prior work (Kirchenbauer et al. 2023 Hu cct al. 2023), we conduct experiments on a subset of the C4 dataset (Raffel el al.]/2020). In addition. include evaluations on three MMW datasets (Piet et al. 2023). Dolly CW (Conover et al. 2023
(Abdin et al. (024) for text generation tasks to
and two tasks from WaterBench (Tu et al. 2023).
For unbiasedness validation, we adopt the settings from Hu et al. (2023) Wu et al. (2023). using MBart (Liu 2020) for machine translation and BART (Lewis] 2019) for text summarization. In the machine translation experiments, we the WMT16 ro-en dataset (Bojar et al. 2016). For text summarization, we use the CNN/DailyMail dataset (See et al. 2017).
Watermarking parameters. We evaluate the detectability of ENS on the text generation task with different language models. We generate 1,000 examples for each task. We the prefix 2-gram together with a secret key as the watermark keys. We select E {0.3, 0.4) } for DiPmark (Wu et al. 2023), tournament sampling layers m {20,30 30, 40) for SynthID (Dathathri et al. 2024). = 20 for MCmark (Chen et al. (025). For 7-reweight (Hu et al. 2023), we follow the settings in the original papers. For watermark ensemble we select n E [1, 5. 10) for DiPmark and y reweight and E [1,3, 5) for MCmark. We report true positive rate under x %% theoretical guaranteed false positive rate (TPR FPR) and the Median p-value.
5.1 DETECTABILITY
The results in Table Telearly demonstrate that our ensemble strategy consistently enhances the de- tectability of logit-based watermarking methods. For DiPmark and 7-rrweight, applying the ensemble
7

---

Published as a conference paper at ICLR 2026
Table 4: Unbiasedness comparison of different watermarking methods on text summarization and
machine translation tasks.
Text Summarization
Machine Translation
Watermarking
Methods
ROUGE-1
ROUGE-2
ROUGE-L
BERTScore
BLEU
BERTScore
No Watermark
0.3768
0.1327
0.2379
0.3175
20.35
0.5576
DiPmark(o=0.3)
0.3767
0.1325
0.2384
0.3170
20.44
0.5583
NWS-DiPmark((=0.33 n=5)
0,3760
0.1317
0.2375
0,3163
20.24
0,5555
UNS-DiPmark(o=0.33 n=10)
0.3768
0.1328
0,2383
0.3167
20.21
0.5588
DiPmark(a=0.4)
0.3768
0.1330
0.2385
0.3178
20.35
0,5559
ASS-DiPmark(a=0044 n=5)
0.3768
0,1326
0,2380
0,3166
20.36
0,5585
ENS-DiPmarkko=044, n=10)
0.3756
0,1322
0,2379
0.3163
20.38
0.5590
7-reweight
0.3767
0.1320
0.2376
0.3165
20.54
0,5588
ENS---tewe)ght((=33)
0.3769
0,1331
0,2385
0.3169
20.23
0,5577
ENS-)-roweigh((x==5)
0.3759
0.1321
0.2378
0.3157
20.45
0.5579
SynthID(m=20)
0.3761
0.1323
0,2380
0.3169
19.82
0.5559
SynthID(m=30)
0.3776
0,1331
0.2387
0.3175
20.15
0,5582
SynthID(m=40)
0.3774
0.1336
0,2382
0,3173
20.28
0.5566
ENS-MCMark((=20,, n=
0.3769
0.1329
0,2386
0.3176
19.83
0.5543
INS-MCMark(1=20,1 n=3)
0.3767
0,1325
0,2380
0.3170
20.43
0.5589
ENS-MCMark((220, 5=
0.3769
0.1333
0.2388
0.3177
20.19
0.5631
scheme substantially boosts TPR across all false positive rate thresholds and reduces median p-values, confirming that aggregation over multiple keys strengthens statistical power. More importanly, when comparing against strong baselines such as SynthlI) and MCMark, our ensemble framework achieves sfate-of-the-ar performance. In particular, ENS-MCMark reaches the highest TPRs and the lowest p-values under both 250- and 500-token settings, surpassing all competing methods and establishing our ensemble method as most effective approach for watermark detectability
5.2 ROBUSTNESS
To comprehensively evaluate robustness, we conduct experiments under challenging text corruption attacks: GPT-4o-mini paraphrasing, DIPPER paraphrasing, GPT-4o-mini English-French back translation, and 10% random token replacement. These transformations substantially alter surface forms while preserving semantics, providing rigorous stress test for watermark detectability. As all watermarking methods experience degraded performance under these attacks. Nevertheless, our ensemble framework consistently yields significant improvements, with ENS-MCMark achieving the highest TPR across all FPR thresholds and the lowest p-values in every attack scenario. These results highlight that, under strong paraphrasing and token-level perturbations, our ensemble method maintains state-of-the-an detectability, clearly outperforming existing baselines.
shown in Tables and 3
5.3 UNBIASEDNESS
To assess the unbiasedness of watermarking, evaluate generation quality across two represen- tative tasks: text summarization and machine translation, using multiple standard metrics. For summarization, report ROUGE-1/2/L. and BERTScore, while for translation BERTScore. See Appendix D for detailed introduction of the metrics. As shown in Table 4 all watermarking methods, including our ensemble variants, achieve scores that are nearly identical to the no- no-watermark baseline. This indicates that, similar to other unbiased watermarking approaches, our ensemble framework does not degrade generation quality. The consistency across diverse metries and tasks confirms that the improved detectability of our ensemble method comes without sacrificing semantic fidelity or fluency of the generated outputs.
adopt BLEU and
5.4 ABLATION STUDY
In this section, study the effect of generation length and ensemble size detectability. All experiments are conducted on Llama-3.2-3B Instruct using the C4 subset, and we report TPR TP.00.01% FPR together with the median p-value.
8

---

Published as a conference paper at ICLR 2026
Thue Posilve Rate (TPR)
1.0
Median PVallue (-log10)
DhS SnSrynomeet provgggttnedd
30
0.8
LNS MONain
685, MoMeIn wal
0.6
0.4
prowiggtiood UnS cin pe EnG1
0.0
100
200
300
400
500
100
200
300
400
500
Longth of text
Figure 1: Effect of the generation length on the detectability, Left: @PR@0.01 %FPR vs. generation
length. Right: median p-value vs. generation length.
1.0
Median povalun (log)
10-7
PVS-Dimanioon..t 0.43
ENS DV5-Gimanioo0
DMS-yeeneegrt gnt
True Postiive Rate (TPR)
0.9
10
ENF mni--iimersta 0.41
ENS DiE-yeennighh:
PNS PiE-Dimmarsion 0.333
True Positive Rate (TPR)
0.6
10
0.5
10-10
0.8
0.4
10
0.7
Median
0.3
MMS-yrowiigh
10
0.6
115 2Pm
10
INC PPP.atm
5.0
10.0
2.5
5.0
7.5
10.0
2.5
5.0
7.5
10.0
2.5
7.5 10.0
Number of Ensembles
Number of Ensembles
Number of Ensembles
Number of Ensembles
Figure 2: Effect of the number of ensembles on detectability. We compare y-reweight and DiPmark
(a 0.3, 0.4) under generation lengths 250 and 500. Left two plots: length=500; right two plots: length=250.
Detectability vs. generation length. As shown in Figure increasing the generation length consistently improves detectability for all watermarking methods. Longer sequences provide more statistical evidence, thereby reducing the variance of detection scores and leading to both higher TPR and lower median p-values. Among the baselines, we observe that ENS-MCmark with 3 achieves the best overall detectability across lengths. Compared to the original MCmark baseline (ENS-MCmark(( = 20, = 1)), ensemble framework significantly boosts detection power while maintaining robustmess. These results highlight the importance sequence length in watermark detection and further confirm the benefit of ensemble- based designs.
Detectability number of ensembles. We further analyze the effect of ensemble size using , 10 under generation lengths of 250 and 500 (Figure 2).
DiPmark and 7-reweight with n = 1,2...., Interestingly, detectability does not grow monotonically with n: we observe that detection power initially improves as ensembles aggregate complementary evidence, but then gradually declines when becomes large. This non-monotonic trend consistent with our theoretical analysis in Sec. 4.3 where excessive ensemble averaging introduces redundancy and dilutes the effective signal. In particular, moderate ensemble sizes (e.g., n = 3-5) provide the best trade-off, achieving the lowest p-values and the highest TPR across both generation lengths.
CONCLUSION
In this work, we introduced ENS, principled ensemble framework for unbiased watermarking that amplifies detection signals while rigorously preserving the underlying language model distribution. By composing multiple independent unbiased watermarks, ENS achieves provable /n gain in signal-to-noise ratio without sacrificing imperceptibility. Our theoretical analysis confirms that the unbiasedness property holds under independent keys, and our experiments demonstrate consistent improvements detection accuracy and robustness to text modification attacks across diverse model families and baseline methods. These results suggest that ENS offers practical and scalable path toward stronger. more reliable watermarking for real- world deployment, helping ensure provenance and accountability in the era of large-scale AI text generation.

---

Published as a conference paper at ICLR 2026
REFERENCES
Scott Aaronson. My Al safety lecture for UT effective altruism, 2022. URL
https://
scottaaronson. 1ttpssonn.boo//pp-62222222
Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, et al. Phi-3 technical report: A highly capable language model locally your phone, arXiv preprint arXiv:2404.142 2024.
Ond rej Bojar, Rajen Chatterjee, Christian Federmann, Yvette Graham, Barry Haddow, Matthias Huck, Antonio Jimeno Yepes, Philipp Koehn, Varvara Logacheva, Christof Monz, Matteo Negri, Aurelie Neveol, Mariana Neves, Martin Popel, Matt Post, Raphael Rubino, Carolina Scarton, Lucia Specia, Marco Turchi, Karin Verspoor, and Marcos Zampieri. Findings of the 2016 conference on machine translation. In Proceedings of the First Conference on Machine Translation, pp. 131-198, Berlin, Germany, August 2016. Association for Computational Linguistics. URL http:/ www. aclweb. org http:/nnhooooggoooo W/ w/w.///w///. /ttpg//////////11122/222222 -
Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang. De-mark: Watermark removal large language models. arXiv preprint arXiv:2410. 0tth:24410.18888 13808, 2024a.
Ruibo Chen, Yihan Wu, Junfeng Guo, and Heng Huang. Improved unbiased watermark for large language models. arXiv preprint vrXiv:2502.1126: 2025.
Yanshuo Chen, Zhengmian Hu, Yihan Wu, Ruibo Chen, Yongrui Jin, Wei Chen, and Heng Huang. Enhancing biosecurity with watermarked protein design. bioRxiv, pp. 2024-05, 2024b.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. arXiv preprint arXiv:2306.09190 194.0099999999 2023.
Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. Free dolly: Introducing the world's first truly open instruction--unnl 1lm, 2023. URL httppp:///w......tttttpppp httpp::/www.tttaariiii... comme http:///w.........oo.......aaaaa
Sumanth Dathathri, Abigail See. Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable water- marking for identifying large language model outputs. Nature, 634(8035):818 823, 2024.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint 2Xxv:2407.21783 2024.
Karl Moritz Hermann, Tomas Kocisky, Edward Grefenstette, Lasse Espeholt, Will Kay, Mustafa Suleyman, and Phil Blunsom. Teaching machines to read and comprehend. Advances in neural information processing systems, 28, 2015.
Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint w:Xiv:2300110663 2023.
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:2310.06825 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. arXiv preprint vxXiv22311.1022 2023.
Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit lyyer. Paraphrasing evades detectors of ai-generated text, but retrieval an effective defense. Advances in Neural Information Processing Systems, (6:27469-27500. 2023.
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv preprint 1xXiv:2307.15593 2023.
10

---

Published as a conference paper at ICLR 2026
Mike Lewis. Bart: Denoising sequence-to so-euueneee pre-training for natural language generation, translation, and comprehension. arXiv preprint arXiv:1910.1341,, 2019.
Chin- Lin. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out, pp. 74-81, 2004.
Liu. Multilingual denoising pre-training for neural machine translation. arXiv preprint arXiv:2001.082/0, 2020.
Yepeng Liu and Yuheng Bu. Adaptive text watermark for large language models. arXiv preprint arXiv:2401.13927, 2024.
Minjia Mao, Dongjun Wei, Zeyu Chen, Xiao Fang, and Michael Chau. A watermark for low-entropy and unbiased generation in large language models. arXiv preprini 2rXXiv:205..440 2024.
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pp. 311-318, 2002.
Julien Piet, Chawin Sitawarin, Vivian Fang, Norman Mu, and David Wagner. Mark my words: Analyzing and evaluating language model watermarks. arXiv preprint arXiv:2312.00273. 2023.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1-67, 2020.
Abigail See, Peter J. Liu, and Christopher D. Manning. Get the point: Summarization with pointer-generator networks. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume Long Papers). pp. 1073-1083, Vancouver, Canada, July 2017, Association for Computational Linguistics. doi: 10.18653/v wwwwwaclwebboo org/ hww.aa/wwww....ggaaa......oooome httgg//ahhhooooooooooooo
URL https
Shangqing Tu, Yuliang Sun, Yushi Bai, Jifan Yu, Lei Hou, and Juanzi Li. Waterbench: Towards holistic evaluation of watermarks for large language models. arXiv preprint arXiv:2311.07138. 2023.
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et Huggingface's transformers: State-of-the-ar natural language processing. arXiv preprint arXiv: 2019.
Yihan Wu, Zhengmian Hu, Hongyang Zhang, and Heng Huang. Dipmark: A stealthy, efficient and resilient watermark for large language models. arXiv preprint arXlv:2310.07710, 2023.
Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluating text generation with bert. arXiv preprint arXiv: 0904 006709975...... 2019.

---

Published as a conference paper at ICLR 2026
A LLM USAGE
We ONLY used ChatGPT-40 and ChatGPTT5 to refine the content.
B WATERMARKING ALGORITHMS
Algorithm ENS generator.
1: Input: pretrained LM PM, secret keys ....... sk,. prompt 2-m:0, generate length T N,
n-gram window length a, logits reweight strategy F, hash function h, n-gram history hist.
2: for = -., T do
3:
Initialize p(O)
M, PM
4:
if at-a.t-1 E hist then
5:
Sampling from the original distribution Par(- mmtt--)).
6:
else
7:
Update hist with 21-0,1-1 for i ,,....,7. do Generate watermark key k; = h(sk, 3t atta,t-1)-
8:
9:
p(1) M.w (-(armm-t))) F(P(i_1) (o((--1/ (-121 - (ki))
10:
Sample the next token z; from p(n) (-1x0 -m:tt-1)))
11:
12: return 21.7.
Algorithm 2 ENS detector.
1: Input: pretrained LM PM. secret keys ski, ... ska, generated tokens æ1.r, threshold do score function 8, logits reweight strategy F, hash function h.
2: Initialize Φ- = 0
3: for ......... T do
4: for i = 1, .......' do
5:
Recover the watermark key h; li(k, B. att-a,-
6:
① = + + s(z
7:
if Φ 2 Pu then
8:
return 1 is watermarked.
9:
else
10:
return 11. is not watermarked.
C MISSING PROOFS
Theorem C.1 (Unbiasednesss) If an unbiased logits-bused bused reweight strategy, and the watermark keys Kin are i..dd from Pk,, then the n-ensemble of F is also an unbiased logits-based reweight strategy, ie..
Ek ENS(n, F, (PPM(24412211 k1n)) = (M-( x1:))
(6)
holds for arbitrary PM (M P and r++1 E V,
Proof. We prove it by induction, when n 1, since an unbiased logit- based reweight strategy, have
E F,
= Ex-Pe [F(Ps (2141 [1a[k))]
=PM(I x1:).
When 1, assuming
E Pm (NNS(n, F, (Mr lan:)) kI..)) Par 11:e)
12

---

Published as a conference paper at ICLR 2026
holds for 1, when m, since km is independent of k1:m-1-
Bk PK ENS(m, F, PMr (11+1 k1:m)]
P E, Pe. F(ENS( - F, P- k1:m-1) 1mm))))
(8)
= k mm ~Pk
[R Pr
(m - Par (a1:t) k1:m [kmm)]]
Since F is an unbiased logits- bassd reweight strategy, we have
Ek... Phmm>PPPP00 PP(NS - 1, F, PMr(-aa1a)) ki:m [im) ENS(m - 1, P, (-r(-lars)) kmmm-1).
Together with Eq. g
E Ex ~ PMt [EN((m, F, Par (2 (2 kimm)
E Bkim- P pm- [ENS(m - F, Pas (.12)1))) kim--)]s
PM x1.)).
(*) refers by induction assumption. Thus. the n-ensemble of F is also an unbiased logits-based based reweight strategy.
D EXPERIMENT SETUP
We assess the unbiasedness properties of various watermarking models across seq2seq tasks: text summarization and machine translation. The experiments are implemented using the Huggingface library (Wolf al. 2019), widely adopted framework in the NLP community for model training and sharing. All evaluations are performed on 8 NVIDIA A6000 GPUs, each equipped with 48GB of memory.
Machine Translation. For this task, we use the WMT 14 English (En) to Romanian (Ro) dataset, which includes 1,999 test examples. The Multilingual BART (MBart) model (Liu) 2020 is adopted, along with its official tokenizer.
Text Summarization. For summarization, utilize the CNN-DM test set (Hermann al. 2015). consisting of 11,490 examples. We evaluate with the BART-large model (400M parameters) and the LLaMA-2 model with 7B parameters.
Evaluation Metrics for Text Quality. To quantify generation quality, we adopt the following metrics:
ROUGE Score. Applied summarization, ROUGE Lin 2004 measures n-gram overlap
between generated summaries and reference texts, reflecting content preservation.
BLEU Score. For translation, BLEU (Papineni al. 2002) evaluates lexical similarity between system outputs and human references.
BERTScore. BERTScore (Zhang et al. 2019) computes semantic similarity via token embedding cosine similarity. We report BERTScore-Fl, -Precision, and -Recall for both summarization and translation.
Perplexity. Derived from information theory, perplexity measures how well probability model predicts text. Lower values indicate stronger predictive capacity. We use assess both summarization and text generation.
E ADDITIONAL RESULTS
In this section, we provide all the experimental results on three LMs: 3........---nsttruue (Dubey et al. 2024),
(Jiang et al.] 2023). and 1ei-3.5-mmii--ie
(Abdin et al.
2024): y and datasets: C4 subset (Raffel et al. 20200) three MMW datasets (Piet et al. 2023), Dolly
CW (Conover al. 2023). and two datasets from WaterBench (Tu al. 2023).
13

---

Published as a conference paper at ICLR 2026
P-Values Length (Llama, 3.2, Instruct, 64, subset)
Detection Accuracy vs Length [Liamaa 3.2, Instruct, c4, subset)
SyrtMM0m=100
1.0
True Positive Rate (TPR)
Median P-Value (-log10)
30
0.8
0.6
Synnh 30
0.4
10
B55-0maanteed3 3
EMS MCM 20
0.0
0
100
200
300
400
500
100
300
500
Length of the text
Length of the text
Detection Accuracy vs Length (Llama, 3.2. 38, Instruct, dolly. cw)
Median P-Values vs Length ILlama, 3.2. 38 Instruct, dolly ow)
1.0
True Posiiive Rate (TPR)
Median P-Value (-log10)
12.5
D55 MCMurth-2 m0l1
Uraar)) -20
PRS. N04M5))-20 2-131
10.0
BIG PiHtrk =20
0.6
E55 SCMuN222000m
7.5
0.4
5.0
2.5
0.0
0.0
0
100
200
300
400
500
100
200
300
400
500
Length the text
Length of the
Detection Length (Llama Instruct. finance,
Median Palluess vs Length (Llama_3.2 3.2_88, Instruct, finance_gol
SymmEim
300
True Positive Rate (TPR)
Median P-Value (llog1))
250
0.8
EMC 25
0.6
150
Synth
0.4
EVS preweghon--
100
ENS 2
0.2
20.
100
200
300
400
500
100
200
300
400
500
Length of the
Length the
Detection
Length (Uama 3.2 Instruct, lengform
Median P-Values vs Length (Liama 3.2 3.2,38 Instruct, longform co)
2.0
300
Synthiigy 301
True Positive Rate (TPR)
Median P-Value (-log10)
250
0.8
MChhAkl-22ae2) ERC. Mchhuki--25---
200
Bnd 21
0.6
150
0.4
EX a 13
prewe
100
Prundaad (mb)
0.0
0
400
Length of the text
Length of the text
14

---

Published as a conference paper at ICLR 2026
MValues Length _32__ Instincct, report)
Detection Accuracy Length (Liama Instruct, mow book report)
1.0
25
16 Se
True Positive Rate (TPR)
Median P Valuue (llog10)
0.8
20
ENG motorrdddaaad
0.6
15
FNC MOHsn)) 2250-15
Symnkame
10-
freikaaa 3.wd))
proseghtnee)
0.2
add endr
0.0
0
100
100
300
400
500
Length of the text
Length of the text
Detection Accuracy Length
Median P-Values Length (Liama 38 Instruct. fake news)
Thue Positive Rabe (TPR)
1.0
Median P-Value (-log10)
ESG geline
E16 mann
50
0.8
40
616 (2Maroin22
0.6
30
SyttExm=3it gharesdi
0.2
mvs sh
0.0
100
200
300
400
500
0
100
200
300
400
500
Length of the text
Length of the text
Detection Accuracy vs Length (Ulema 3.2, 36 Instruct, mmw mmmw.storr)
Median Length
story)
1.0
Median P-Value (-lgg10)
True Positive Rate (TPR)
ENS stenns)
30
FW5, McManil 20,n
BR5, ME9eridee2..ms
0.6
Sync Bimw33)
0.2
glanee))
10
Esd, vowano) 36m-3)
0.0
100
200
300
400
500
100
200
300
400
500
Length of the text
Length text
Detection Accuracy Length (Mistral, 78, Instruct v0.3, 3, c4 subset]]
Median P-Values Length (Mistral 7B Instruct v0.3. c4 subset)
True Positive Rate (TPR)
1.0-
Median PVVauue (-lag10)
15.0
Syth 200
D65 Ntom 3.ned)
0.8
12.5
ENC NCHuabl-223ee5
10.0
ENC (CH4000) -
Sonth lon T0
7.5
0.4
BS Pruntue
Prunsiond A.eb)
5.0
D45 25-50-220055
0.0
0.0
100
200
300
400
500
Length of the text
Length of the text
15

---

Published as a conference paper at ICLR 2026
Detection Accuracy VS Length (Mistral Instract, v0.3, dolly.co
Length
doily ow)
True Positive Rate (TPR)
1.0
215 Cimmattoon 3.r5d
Median P-Value (:logoo)
15.0
DSS corrrry Azeii
DVS ophanigee S.
365 maaeigtthh-1
365, UCtant 20 10
12.5
DNG NCtrunlt 20,--1
DVS m
255, RCRusti=20
MCMerel 20m DND, MCVass))0200mm
0.6
Vclant) -
10.0
7.5
5.0
0.2
2.5
0.0
0.0
100
200
300
400
300
400
500
Length of the text
Length of the text
Detection
(Mistral.
Median P-Values vs Length (Mistral_ 76, IB__nstrutttu v0.3, finance_oa
True Positive Rate (TPR)
1.0
Synch Djn-33)
HSC PicccPma/ee00ttm
Median P-Mauue (log10)
12.5
345 PR0-Chtrrrkien pan Ky101
MNG-Chrraatee0.33. Jandi
0.8
10.0
0.6
7.5
0.4
2.5
0.0
0.0
100
200
300
400
Length of the text
Length of the text
Median PAbllus
(Mistral, Instruct longfom_an
Detection Accuracy vs Langth [Mistral 78, Instruct v0.3, longfarm qal
True Positive Rate (TPR)
1.0
Median P-Value (-log10)
15
B85 www.rginnn -1
DI5 Prariee 6 633--
0.8
BRC POOuui =2tuet)
(OHan)) -20m-3)
0.4
BKs (atorth----t--0
Stéraite 6.30n-5)
0.0
0
200
300
400
200 Length of the text
Length of the text
Median P-Values Length (Mistral_ 78 Instructt vo.3, mmw. book report)
(Mistral Detection Accuracy vs Length (Mistral 78, Instruct vo.3, mmw, boak report)
2.5
Sy0tiinnmm 301
Median pazalue (-log10)
085 rewesfbret
20
0.8
B8S Mann--22-- n-
185 22
Positive
0.6
2isottranteee33 S tesotthatteet Anwet
V00, muraak wad andl
100
200
300
400
500
100
200
300
400
500
Length the text
Length the text
16

---

Published as a conference paper at ICLR 2026
Median Length jnstrucc_to....
Detection Accuracy Longth Instruct, vo.3, mmw take, news)
True Positive Rate (TPR)
1.0
Median Value (log10)
20-
too Pirantann Am-
ESG (mengighnne
0.8
ESG Mottr o3-22
15
ESS MOHar)) 22.02.
0.6
10-
Othr ensgent (edd
510 preecighties
0.2
0.0
500
100
200
300
400
Length of the text
Length of the text
Median P-Values Length (Mistral 78 Instruct v0.3, story)
Detection Accuracy Length Instruct story)
Syrthi2mme30
1.0
Thue Positive Rate (TPR)
Median PValuue (-log10)
EIS E15
Els grtin.
0.8
20
0.4
0hS- D Tiaaailion om 3.ed]
p-maatto 4
McMaddl
th5 Mctruni--ooeee
0.0
500
200
300
500
Length of the text
Length of the text
Modi P-Vllues Length mini Instruct, subset)
Accuracy Length (Phi 3.5 c4 subset)
1.0
Median P-Value (-log10) O))
True Positive Rate (TPR)
60
TN5 (otaakk-2200 mi3)
IHS MCMMark2-20 a-d)
2N5. MCCKurk)=20.oe nwdd
0.6
40
0.4
yrows ge
20
PMS McMoro 20
EMG. NoMuroo-20.oeg
0.0
100
200
400
500
0
100
400
Length the text
Length of the text
Detection Accuracy Length (Phi_3.5, 3.5
instruct, delly,
Median PaValues vs Length (Phi, 3.5 mini instruct, dolly cw)
Sorth (Xm=30))
True Positive Rate (TPR)
1.0
Median Payalue (-lgg10)
ENS DiProntjoa 4m
EMS rewsghhttit
30
0.6
Syrth m-3
0.4
E45 yrens shoines
215.0 AAyey
10
0.2
0
100
200
300
400
500
100
200
300
400
500
Length the text
Length of
17

---

Published as a conference paper at ICLR 2026
Longth (PN, mini, Instruct, go]
Detacttion Accuracy vs Length (Phi 3.5_ 1ini Instruct, financegga)
Syrri Dimw33)
True Positive Rate (TPR)
1.0
Median P-Value (-log10)
30
0.8
MC
20
0.4
586 2i En nw))
3M2 34 (
10
0.2
242 -
0.0
100
200
300
400
500
100
200
300
400
500
Length the
Length of the text
Median P-Values vs Length (Phi, 3.5, mini, instruct, longform, ga]
Detection Accuracy vs Length (Phi (a_mmmnniiie instruct, longform, sa)
50
Sym. (hm=33))
True Positive Rate (TPR)
1.0
Median P-aalue (-log10)
(1owestoow)))
40
0.8
0.4
ENG a 3aad
0.2
10
MCHorti 20
0.0
0
100
200
300
400
500
100
400
Length of the text
Length of the text
Detection Accuracy vs Length (Phi 3.5 mini Instruct, mmw book report)
Length (Phi 3.5, mini instruct, mmw book report)
1.0
Median P-Value (llog10)
50
D15 Pransiae
True Positive Rate (TTR)
B65 Prannin- 30-5)
0.8
40
D65 INCHN6ll-2200 220-11
BND McHaNim222m0)
30
Dy X0
0.4
Clmmancand mwd)
20
oivaangge
0.2
10
ENG 31
100
200
300
400
500
1.00
200
300
400
500
Length the text
Median P-Velues vs Length (Phi 3.5, mini instruct, miww fake, news] 60
Detection Accuracy vs Length (Ph) 3.5 mini Instruct, mmw. fake, news)
Synth 200
Thue Positive Rate (TPR)
1.0
Median P-Valuc (-log10)
ENS 44Paanoo--3
40
ENS. (22
190. (0
ENC. (33
0.6
0.4
EMS mmanightt--
20
EMS Staasta--344a-
10
EMC MC sin-o0teet
0.0
300
0.
100
300
400
500
Length of the text
Length the text
18

---

Published as a conference paper at ICLR 2026
Detection Accuracy vs Length (Phi 3.5 miri, instruct, mmw mmw.story)
P-Values Length 3.5, mini Instruct, mmw story)
1.0
True Positive Rate (TPR)
Median P-aalue (-log
80
0.8
60
INS NO.un))-22,m31
0.6
Semt 301
0.4
Saaant 8.3
20
0.0
0
100
200
300
400
100
300
500
Length of the text
Length of the text
19


Reviews:
[{"review_id": "W6n2sM0mjc", "reviewer": "Reviewer_SgCe", "summary": "The paper proposes, ENS, that composes several unbiased, logits-based watermarking steps keyed independently. The authors prove the composition stays unbiased in expectation and analyze how aggregating per-key detectors changes the testing signal. Empirically, they report improved detection and robustness across multiple model families, with little to no degradation in standard text quality metrics. However, I think the paper only studies the effects on standard generation metrics. \n\nThe mains claims are as follows\n- Unbiasedness under composition. If a single reweighting rule is unbiased, the n-fold ensemble remains unbiased when keys are i.i.d.; the proof is a short tower-property induction.\n- Detection scaling. With per-key scores that are (approximately) independent and bounded, the aggregate statistic has mean proportional to n and variance proportional to n, implying SNR ≈ (µ/σ)√n and p-values that improve with n.\n- Trade-off: Under “intersection-at-generation,” the per-step effect shrinks like (εγ)^n, so the exponent in the p-value bound behaves like n(εγ)^2n with an optimum n⋆≈1/[2log(1/(εγ))].", "questions": "See above", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- The paper cleanly separates two questions: preserving unbiasedness and recovering detection power. Theorem 4.2 (composition stays unbiased) is simple and well scoped; I didn’t find hidden caveats beyond key independence.\n- The SNR and Hoeffding arguments are standard but appropriate for bounded per-key scores (e.g., DiPmark). The text is careful to say the exponential improvement can attenuate in practice.\n- Results include multiple LM families and several corruption settings (paraphrasing, back-translation, token replacements). The tables make it plausible that the ensemble generally helps and that quality remains close to baseline.", "weaknesses": "- The SNR and p-value scaling assume per-key independence; the paper notes dependencies via overlapping n-grams and proposes bypassing repeats, but I didn’t see a quantitative study of how correlations impact power. This matters because the theoretical √n gain can compress substantially with even mild correlation. \n\t- Add a small study where you control n-gram overlap or reuse keys to measure empirical correlations among per-key scores and the resulting deviation from √n SNR. This would tell readers when the ideal scaling is trustworthy.\n- The trade-off section is framed for strict intersection; many practitioners would avoid hard intersections and instead add small centered logit shifts per key. It would help to show the same analysis (or an empirical proxy) for a soft/additive design where the (εγ)^n collapse is muted\n- The paper uses an aggregate statistic (one test), which avoids multiple-testing corrections, but it would help to explicitly say how thresholds are set to fix FPR across n (so readers don’t assume Bonferroni is needed).\n- Your theory predicts where detectability should peak.  Show an experiment that sweeps the relevant parameters so readers can see whether the peak occurs where theory says it should.\n- Recent work suggests watermarking can change model behavior beyond detectability/quality tradeoffs: Downstream Trade-offs of a Family of Text Watermarks (Ajith et al., EMNLP 2024) finds 10–20% drops on downstream tasks even for “unbiased” schemes like KGW; WaterJudge (Molenda et al., NAACL 2024) quantifies a detectability–quality trade-off; and Watermarking Degrades Alignment in Language Models (Verma et al., ICLR 2025) shows shifts in truthfulness/safety/helpfulness that can be partially mitigated with an external reward model. The paper would be stronger with a targeted experiment evaluating how ensembling affects alignment-relevant metrics (e.g., reward scores ), and a short discussion of these works to contextualize potential side effects.\n\n\n\n### Nits\n- Define ε and γ at first mention in the trade-off subsection; they appear earlier in the derivation than in the surrounding text.\n- Line 87 rejected-sampling , typo?\n- Line 119 putative text sequence, typo?\n- Line 190 DETECT EFFICIENCY -> Detection Efficiency?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Wajhi1bHuH", "reviewer": "Reviewer_y1fL", "summary": "This paper proposes ENS, a general ensemble framework for logits-based unbiased watermarking in LLMs. The key idea is to sequentially compose multiple unbiased watermark instances (with independent keys), amplifying the watermark signal while theoretically preserving unbiasedness. The authors prove that ensemble compositions remain unbiased and show detection signal scales as $\\sqrt{n}$ with ensemble size. The authors also conducted evaluations on multiple LLM families and datasets to validate their algorithms.", "questions": "Do you have any advice for tuning the ensemble size?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. Clear Motivation: ENS addresses the main weakness of unbiased watermarks: weak detectability at short lengths.\n\n2. The proof of unbiasedness is rigorous, with extensions on independence assumptions and variance scaling.\n\n3. The experiments are comprehensive. The proposed method is compared against strong unbiased baselines e.g. SynthID. The experiments cover both detectability and robustness, using realistic paraphrasing and back-translation attacks.\n\n4. The experimental results are strong. There are significant TPR@FPR gains of ENS. Besides, ENS-MCMark achieves state-of-the-art robustness and detectability across attacks.", "weaknesses": "1.\tENS requires multiple independent keys per generation step, which may introduce storage, distribution, and synchronization complexity in real deployment.\n2.\tDetection power declines for large ensemble sizes, aligning with theory but reducing scalability. Choosing optimal n becomes another hyperparameter to tune.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qJTTcRyTIE", "reviewer": "Reviewer_rySn", "summary": "This paper proposes ENS, an ensemble framework that enhances logit-based unbiased watermarks by amplifying the watermark signal. The idea is simple: each logit-based unbiased watermark can be viewed as a distribution reweighting function $f_i$. By ENS, different distribution reweighting functions are nested, i.e., $f_i( f_{i-1} (\\cdot) )$. Intuitively, the nested function is also unbiased but enhance watermark strength.", "questions": "1. The authors can elaborate further on Section 4.3. Specifically, what is the effect of $n$? The authors argue that in practice, it is important to select $n$ close to the optimal by balancing the tradeoff between aggregation gain and sparsity loss. The experimental results also suggest that an intermediate $n$ achieves better performance. Although I generally understand the idea that a large $n$ reduces the detectability but not significantly, the analysis in Section 4.3 is not sufficiently clear. \n2. From Table 1, the TPR@0.1%FPR score of ENS-Dipmark seems to achieve its optimum when $n=5$. Theoretically, I am also curious about the performance gain bound by ENS. Could the authors provide some analysis of the improvement by ENS? For example, specifically for Dipmark, what is the expected gain in detectability for $n=2,3,\\cdots$?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The idea is easy to implement but effective. \n2. The authors conduct different variants of ENS-enhanced watermarks, which all show the efficacy of ENS according to the experimental results. Specifically, the authors show the unbiasedness, robustness, and higher detectability via ENS.", "weaknesses": "1. Potentially, if an unbiased watermark is enhanced, it is possible that the probability distribution is altered too much under certain watermark keys. Therefore, the method may not perform well in low-entropy scenarios. However, since this is not the focus, the authors could discuss this limitation in future work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HmHGsVw4lh", "reviewer": "Reviewer_mMdf", "summary": "This paper investigates the problem of watermarks for language models. A watermark is a statistical signal hidden inside text that can be detected by anyone with access to a secret key but is intended to not distort the quality of text, thus remaining undetectable to observers without access to a secret key. Many schemes have been instantiated for autoregressive models by modifying the sampling procedure of models, with a prominent such scheme being the green list approach, where a hash function looks at the recent context and returns a pseudorandom subset of the vocabulary to upweight in generation.  This scheme proposes to construct an ensemble of watermarks by recursively applying a key-based reweighting scheme with different keys to the distribution of the next token in order to inject additional detection power.  The authors then instantiate their ensemble based approach with a variety of watermarking schemes and demonstrate empirical efficacy in improving watermark detectability and robustness after carefully selecting their hyperparameters.", "questions": "See weaknesses.", "limitations": "", "rating": 2, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 1, "strengths": "One strength of this paper is that they identify a new axis for improving the dectectability and robustness of language models.", "weaknesses": "First, the authors incorrectly suggest that SynthID requires $2^{30}$ redundant tokens to generate a single token.  As the authors of that paper state clearly in the methods and in the appendix, they apply a vectorized approach to tournament sampling in practice that does not induce this redundancy.\n\nSecond, I am a little confused about the additional novelty of the present work with respect to tournament sampling.  While I agree that synth-id uses a particular instance of the ensembling framework introduced in definition 1, I think more clear differentiation could be described.\n\nThird, the statement on lines 204-205 about unbiasedness ensuring indistinguishability is not true.  See, e.g. *Black-box detection of\nlanguage model watermark* by Gloaguen et al 2025.\n\nFourth, the fact that there is non-monotonic improvement with $n$ is a bit unfortunate and seems like it is an artifact of the precise way that the elements of the ensemble instantiate the watermark, i.e. by using some fraction of the vocabulary as a greenlist which then becomes exponentially small in intersection.  This does not seem like a fundamental barrier but rather a specific pathology of the greenlist paradigm.  Tournament sampling for example does not suffer from this failure mode.  I think the authors should discuss this.\n\nFifth, I am curious as to the additional sampling time overhead required to implement this approach, as well as how this scales as a function of $n$.\n\nSixth, I think this paper can benefit from comparison with additional related work, such as those watermarks that are imbedded directly into the model weights, e.g. *GaussMark: A Practical Approach for Structural Watermarking of Language Models* by Block et al 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)