Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Authors: Xiaojun Xu
Jinghan Jia
Yuanshun Yao
Yang Liu
Hang Li
Venue: ICML 2025 poster (2025)
Keywords: Text Watermark
LLM
Primary area: deep_learning->generative_models_and_autoencoders

Abstract: We propose an imperceptible multi-bit text watermark embedded by paraphrasing with LLMs. We fine-tune a pair of LLM paraphrasers that are designed to behave differently so that their paraphrasing difference reflected in the text semantics can be identified by a trained decoder. To embed our multi-bit watermark, we use two paraphrasers alternatively to encode the pre-defined binary code at the sentence level. Then we use a text classifier as the decoder to decode each bit of the watermark. Through extensive experiments, we show that our watermarks can achieve over 99.99% detection AUC with small (1.1B) text paraphrasers while keeping the semantic information of the original sentence. More importantly, our pipeline is robust under word substitution and sentence paraphrasing perturbations and generalizes well to out-of-distributional data. We also show the stealthiness of our watermark with LLM-based evaluation.

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Xiaojun Xu'
Jinghan Jia
Yuanshun Yao Yang Liu 3* Hang Li
Abstract
We study the methodology of injecting multi-bit water- mark message into piece of text by paraphrasing. The wa- termarked text will keep the semantic meaning of the orig- inal text after paraphrasing. Another paired decoder will be used to decode the message from the watermarked text. Unlike lexical-based watermarks which inject watermarks by synonym substitutions, the paraphrasing based method has a larger action space for watermark injection and also is more robust under perturbations. However, there also challenges in designing paraphrasing-based watermarks, as it is unclear on how to properly inject imperceptible but detectable watermark signal while keeping the text quality and original semantic meaning.
We propose an imperceptible multi-bit text watermark embedded by paraphrasing with LLMs. We fine-tune a pair of LLM paraphrasers that are designed to behave differently so that their paraphrasing difference reflected in the text semantics can be identified by trained decoder. To embed our multi-bit watermark, we use two paraphrasers alternatively to encode the pre-defined binary code at the sentence level. Then we use a text classifier as the decoder to decode each bit of the watermark. Through extensive experiments, we show that our wa- termarks achieve over 99.99% detection AUC with small (1.1B) text paraphrasers while keeping the semantic information of the original sentence. More importantly, our pipeline is robust under word substitution and sentence paraphrasing perturbations and generalizes well to dit-o--iistiibutioonal data. We also show the stealthiness of our watermark with LLM- based evaluation. We open-source the code: https://gitthii com/xt jojunxu/ multi-bit-a wattttt-tettwwterraee
In this work, we propose a paraphrasing- based watermark by simultaneously fine-tuning LLM-based paraphraser as the encoder and train LM-based text classifier as the decoder. The pipeline is shown in Figure 1. In the encoding stage, we will paraphrase the input text conditioned on a user-chosen key to generate the watermarked text. In the decoding stage, we will extract the code from the input text with the decoder and compare with the previously chosen key if it is watermarked by the user.
The key to produce a high-quality text watermark in our method is to train a good encoder-decoder pair. For the de- coder, we can train with standard classification loss so that it can better classify between "bit-O texts" and "bit-l texts". For the encoder, we would like fine-tune so that its generated text can be better classified by the de- coder. Inspired by (Xu et al., 2024), we show that we use the decoder as reward model to evaluate how well the paraphrased text generated by the encoder can be correctly classified. Thus, we can use PPO-based RI. techniques to finetune the encoder so that the injected watermark can be better decoded. We adopt a co-training framework so that the encoder and decoder are alternatively updated during the training process.
1. Introduction
Text watermark aims to encode some imperceptible signal into a piece of text so that people are able to decode the sig- nal from the text (Liu et al., 2024). It can be useful in var- ious applications such as copyright protection and hidden message communication. With the development of Large Language Models (LLMs), there is also a growing need to track misinformation spread by LLMs using text water- mark injected to model outputs (Kirchenbauer et al., 2023).
Through experiments, we show that our experiments can achieve a very high watermark detection performance while maintaining the paraphrasing fidelity. We achieve over 95% bit accuracy and over 0.99 detection AUC, both outperforming existing methods significantly. In addition, we can apply simple repetition baseed strategy and im-
Work done while ByteDance. 'ByteDance Research "Michiaan State University Universsity of California, Santa Cruz. Correspondence to: Xiaojun Xu <xiaojun.xue skiioojnnxu@byttddanncccomm bymm
Proceedings of the 1nnd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
prove the detection AUC over 0.9999. In addition, our method also shows good robustness under word substi- tution and sentence paraphrasing perturbations. We also evaluate our methods over out -ittiiibbbuuti (OOD) data and observe that our model can achieve over 0.99 AUC for most of the OOD tasks. All these results show the effec- tiveness and robustness of our watermark.
that the error rate after perturbation MMpert len( per)lo should be low.
The watermark should not be easily de- tected by human eyes. We evaluate it with the crite- ria that human cannot easily detect the watermarks in the text. Formally speaking, let M = Dhuman (x**) be the human guess on the watermark code. We hope that M - M (
Stealthiness:
The rest of the paper is organized as follows. We will first introduce the preliminary knowledge of the work in Sec- tion 2. Then we introduce our paraphrasing-baser water- mark methodology in Section 3. We will show the exper- iment results in Section 4. Finally, we discuss the related work in Section and conclude the work in Section 6.
should be high, i.e. human guess on the watermark code has high error rate.
2.2. Background: PPO
Proximal Policy Optimization (PPO) (Schulman et al., 2017) a standard way to optimize a language model to- wards a high reward calculated by some pre- pre-defined reward functions r(x) IR where x is the input text (i.e. a se- quence of tokens). Let π (xe((z<)) denote the probability of generating token H; given the context, and (-I(=<))) de- note the overall probability vector. We use to denote the model to train and Fref to denote a reference model. Peo- ple will first estimate an "advantage" at each step A Ax()) given the final reward r(z), which approximates how each token contributes to the final reward. There are different choices of how to estimate the advantage. We use the Gen- eralized Advantage Estimation (GAE) (Jaques et al., 2019; Zheng et al., 2023) with critic models, which we omit the details here. Having the advantage (z) at each step, the PPO algorithm will optimize the input x by minimizing the following loss:
2. Preliminary
2.1. Goal of Multi-bit Text Watermark
The goal of the work is to inject a multi-bit watermark mes- sage into a piece of text by paraphrasing. Formally speak- ing, the watermark injection stage, we are given an orig- inal text xx and a watermark message M E (0. We will inject watermark by generating new watermarked text with a encoder zn E(x", MM. To extract the wa- termark, we will use watermark decoder M' D)= to decode the injected watermark. We hope that the de- coded bits should match the prefix of the designed water- mark message, i.c., M' = M: len(M')]. Note that this a vary-length watermark, where the length of watermark message is dependent on the length of text- the longer the text is, the more information we can encode in the water- marked text. This is contrary to the fix-length text water- mark (e.g. (Zhang et al., 2024b)), where the watermark code is a fixed length for any given input text. The length of M' depend on different watermark designs, and we will introduce them in Section 1.
l (ppo((;))= - =
( (- Ey To( (x))]
Traes (2e xxc)
+ >o (L((((--( Tres( (ret))
(1)
where the first term is to maximize the expected advan- tage on each token, and the second term is to regularize the model to not drastically change from the reference model.
We have the following requirements on the paraphrased text:
3. Methodology
The watermarked text should not change the meaning of the original text. The similarity sim(2", x²)) should be high.
Fidelity:
3.1. Overview
We illustrate the high-level pipeline of our watermark in Figure 1. Our core idea is inject the watermark into a piece of text by paraphrasing the text include the im- perceptible watermark signal, which can be later decoded by a text classifier. To encode a watermark message into a piece of text, we will apply LLM- paraphraser con- ditioned on one watermark bit (0 or 1). The watermark bit is initialized as the first bit of the watermark message, and updated to later bits during the token-by token-by-token by-token generation
Accuracy: The watermark decoder should accurately decode the watermark message. The error rate M' M[: lenl M))lo should be low.
Robustness:
The watermark message should still ex- ist after the watermarked text undergoes some pertur- bation. Let Mperr = D(pert(x"") denote decoded message from perturbed watermarked text. We hope
2

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Watermark Encoding
? 0000
User-chosen Key
Original Text
Watermarked Text
propose a pipeline inject multi-bit text watermark. We encode the watermark by paraphrasing a piece of text using special paraphrasers. Then the watermark can be detected by our trained decoder.
We propose method for multi-bit text watermark injection. The watermark is encoded into a piece of text with special paraphrasers: We then detect the watermark using our trained decoder.
Encoder [Paraphraser]
Decoded key
User-chosen Key
We propose method for multi-bit text watermark injection. The watermark is encoded into piece of text with special paraphrasers. then detect the watermark using our trained decoder.
? 010
010
Decoder (Classifier)
Test Text
Watermark Decoding
Is Watermarked
Figure I. The overview of our watermark pipeline. During encoding, we use an encoder to parapharse the input text given user-chosen key. During decoding, extract the bits from the text using the decoder.
process. Different segments in the generated text will cor- respond different bits the message code. To decode the watermark message from a piece of watermarked text, will divide the text into multiple segments, and then apply the LM-based classifier to determine the watermark bit for each segment. The concatenated message is the decoded watermark message.
on LLMs. Our design of the encoder is to have two LLM- based paraphrasers (0u, (1) and use them alternatively in the token-by-token generation process, which is based the current watermark code determined by the sentence segmentor. Formally speaking, let x; = f(x" r 0,) denote the process of generating the next token when para- phrasing the input x parametrized by 6,. The encoding algorithm shown in Alg. We track the current water- mark bit, and the next token is generated with the corre- sponding paraphraser 6sa- After each generation step, check whether the next token will be in new segment by calculating S(x""; mode=E). If the new segment starts, we will update bit to be the next bit in the watermark message.
Text Segmentor Note that both processes require a mechanism divide text into segments, so that we can assign one bit to each segment the to inject multi-bit watermark code. We use "text segmentor" S to do the segmentation, which will operate in two different modes during encoding and decoding. During encoding, it will take the current generated text and output boolean value S(x) mode=E) E {0, 1} to determine whether the next to- ken will belong to a new segment. During decoding, will take piece of text z as input and segment into a list of segments (odd==/) = [T1, T2, ..]. In this work, we the sentence-level, i.c.
3.3. Decoder: LLM-based Text Classifier
The decoder D will decode the watermark code from a piece of text and get M' = D(x") E {0, 13". We use g(:; 0a) E {0, to denote binary classifier on a text with parameters 02. and use gx; 02) (0, 1) denote the predicted probability of class-l. The decoding algorithm is shown in Alg. 2. We will segment the input text into mul- tiple segments S(æ; mode=D). then apply the classifier to each segment to calculate the decoded watermark.
choose to do the segmentation every sentence in the text is segment. We view it as sim- ple yet robust choice, as word-level injection/deletion will not change the segmentation, and paraphrasing will also keep the sentence order in most cases.
3.4. Co-training Framework
3.2. Encoder: LLM-bbsed Paraphraser
The training framework is inspired by (Xu et al., 2024), which shows that the text classifier can be viewed as a "re-
The encoder E aims to paraphrase the input text based on a given watermark code and get xe F(xx, , M) based
3

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Algorithm Watermark Encoding Algorithm x=
given original text x², watermark code M and the water- marked text xthh E(x", M), the watermark reward rw is calculated by:
Ela", S, 1,0,0,0,0, 01)
Require: Input x"; Watermark code M: Text segmen- tor S; Parameters for two paraphrasers 8g and 01.
(()))))
Ensure: Watermarked text x:
(w M) - Σ
[D(x")]== M[]
(3)
x= +]]
2: 0 /+ index of current watermark
bit */
In addition, will also calculate similarity reward r' "=(" (z"",, 2²)) with text similarity model. The overall reward is weighted sum of the two rewards:
3: while x=( [-1] + (EOS) do
4: bit + [i]
5: x= ."".append(f xx"; 0
6: / switch to the next bit if the current segmentation ends. */
r(x", x,, M) Aw (w .M d """""",""" (4)
7:
if modd then
Having the reward, we will use the PPO algorithm to up- date the parameters (0o. 01). One change in our PPO loss is that our x is generated by two models dy and f1, so each model only needs to update on the inputs that are gen- erated by each model. The formal PPO loss for encoder, assuming have calculated the advantage (x Fo: M) (which we will abbreviate as A, without ambiguity), is as follows:
8: i i- +++1
9:
end if
10: end while
11: return xt
Algorithm Watermark Decoding Algorithm M' D(a";S,0a) S,0a).
Require: Input text z"; Text segmentor S; Parameters for the text classifier Og-
fg(Ou. 01) =
10g E1 To. (1+x2))) (- RBg
To, (20 (x))) Ai] Tree (I xi(e)
Ensure: Decoded watermark M'
1: M' [[]
+ A KLL (rer((
2: for 2; E S(x"; mode=D) do
4: end for
3: M' Maaappendgg(Z; 0a))
Σ lixe Te, (+x20)
(-Bol
Tros ( (1))
E1
Te, (ze) Ar]
5: return M
+ A AN (11r))) Tre (((e))))))
(5)
ward model" to finetune LLMs with PPO, and that the text classifier and the LLM can be trained alternatively. our
where the information of whether x, is generated by Oo or 01 is recorded during the generation stage.
work, we will alternate between two goals: optimizing the
decoder (92) and optimizing the paraphrasers (0g and 01).
The goal of the decoder is to accurately classify each bit of the original watermark code M. We use the cross entropy loss to optimize the decoder:
The algorithm is shown in Algorithm 3. We will have a dataset consisting of original texts x,, In each training step, we randomly sample watermark key M. Then we cal- culate the watermarked text V. with the current encoder (0o, 01) and the advantage function with the current de- coder 0g- Finally, we update the encoder and decoder with the respective losses.
ID(x*))
M) "M,xx,,,==- Σ
MM] 9. 9. (xT;
+ (1 - ((]) (1 - (1-9a(ā)) :
(2)
Initialization In practice, we observe that the training performance heavily depends on the model initialization. This expected, as the encoder and decoder rely on each other to do the update and therefore requires good ini- tialization the update of (0,,0z) needs the reward pro- vided by Os, and the update of 0₂ needs the samples gen- erated by (0o, 0z). In our implementation, we will first initialize (6g. 0,) with supervised finetuning (SFT) loss on paraphrasing dataset DSFT = {(xS .IS(TT) }. We will simultaneously finetune the two models 0g and
The goal of the encoder to generate inputs that can be better recognized by the decoder, while keeping its normal utility (i.e. good paraphrasing performance). To opti- mize the encoder, we utilize the idea of PPO that LLM can be fine-tuned with RL-based techniques with respect to a reward model. Here, the decoder is used to calculate the "reward" of how the output of encoder can be success- fully decoded as the original watermark code. Specifically,
4

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Algorithm 3 Training Algorithm of the Encoder and the
We fine-tune the model for 10,000 steps with batch size of
Decoder.
4. We use Xu: 0.1, X 1.0 and X 0.02 as the efficients. In the initialization stage, we will generate the paraphrased data xSFT para with Pegasus paraphraser (Zhang et al., 2020), and use ÁSS = 1.0 for the intialization loss.
Require:
Dataset D; Initialized parameters Po, 01, Oz; Text
Segmentor S
1:
Ensure: Trained parameters lo. 01. 0g
2:
Metric We evaluate three types of metrics of a text wa- termark. The first type is the bit-wise accuracy, which eval- uates how good the multi-bit watermark code is extracted. This includes the bit-wise accuracy (Bit Acc) of the de- coded watermark and the number of total bits injected in the text (Bit Num). The second type is the text-wise ac- curacy, which evaluates how well we tell the water- marked text apart from other non-watermarked text. We will evaluate the decoder on both watermarked and non- watermarked texts, and calculate the area under ROC curve (AUC) and true positive rate under 1%, 0.01% % false positve (TPR @ FPR=1%, TPR @ FPR=0.00 %). For the fidelity, we calculate the similarity with the all-mpnet -base-v2' model following the setting in (Lau al., 2024).
3: for all Ho E D do
4: M [0,
5: Fw E( 80,
6: Calculate the advantage function A, Ar(Tu, Co, M)
with the reward function in Equation 4,
7: Update 0₂ with decoder loss (0,; x", M) in
Equation
8: Update Bg, 01 with the encoder loss E (0o, f AA) in
Equation 5.
9:
end for return M'
10:
0 the paraphrasing dataset and hope that they both have a small loss, but they also have difference in their behaviour (measured by IS divergence), with the loss ( 01:20 .xpara) (denoted as lina (fo, 01) for simplicity) as follows:
Baselines
We evaluate various baseline methods with dif- ferent design ideas:
linit (oo; 01:) = (SrT(f0; No SFT .spara)
RemarkLLM (Zhang al., 2024b). The idea is to use fixed-length multi-bit watermark key and train a Transformer-based paraphraser with a watermark detector. The paraphraser is trained with Gumbel reparametrization techniques to minimize the decod- ing error. We use the T5-based paraphraser in their original setting and evaluate both the 4-bit version and 8-bit version of the watermarking model.
+LsFT(01i3) SFT Ipara)
-Ais JS(TT, (2 (a ( ) no, (1r ao SFF)))
After the paraphrasers are finetuned, we will generate watermarked texts xx with randomly sampled water- mark code M, and initialize the decoder by optimizing ( .M) in Equation 2.
KGW (Kirchenbauer al., 2023) and KTH (Kudi- tipudi et al., 2023). They are LLM-based watermarks aiming to inject watermark to L.MM-genrrttr texts by altering the token sampling strategy during the gen- eration stage of a LLM. Note that their methods are not directly comparable with ours, as they are not de- signed to watermark non-LLM LLge-eerrtteed text. For comparison, we adapt them watermark any text with variant, zero-bit and multi-bit. In the zero- bit variant, we directly apply KGW or KTH to LLM-based (1. (B.IB) paraphraser, which is then used to paraphrase the given text to inject watermarks. This is a zero-bit watermark as the detector can only tell whether a text is watermarked or not, but no other information will be carried in the watermark. In the multi-bit variant, we will apply KGW KTH two LLM-based paraphrasers. Then we use them as 0g and
4. Experiments
4.1. Setting
Model and Training Settings We use relatively small TinyLlama-I.Ib model architecture (Zhang et al., 2024a) for lg. O1 and fg as we observe that small models can al- ready achieve good performance paraphrasing and wa- termarking. We show the experiments with larger Llama- 2-7b models in Appendix C. The detailed prompt used by the pararphrasers are shown in Figure 3 in Appendix A. The encoder and decoder are trained and evaluated on the C4 RealNewsLike dataset (Raffel et al., 2020), processed using standard settings in (Kirchenbauer et al., 2023; Xu et al., 2024; Lau et al., 2024). Without specification, we will use texts with 128 tokens for training and evaluation.
s sentence tenteenceetraseee taanttttrannnnsra
/all 1atps////lllmltlteeeeee -mpnet- -mpnet-base-e. base-v2
5

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Table 1. The performance of watermark compared with baseline methods. The RemarkI.LMM method uses the T5 (Raffel al., 2020)
model following their original settings. Other methods use TinyLlamal.. 1. (Zhang et al., 2024a) as the paraphraser. The bit-wise accuracy marked "." if the method does not support multi-bit watermark code.
Bit-wise Accuracy
Text-wise Accuracy
Fidelity
Method
Bit Acc
Bit Num
AUC
@ FPR=1% TPR@FPR=0.01%
Similarity
RemarkLLM (4bit)
0.7663
4.0
0.7861
0.0%
0.0%
0.8096
RemarkLLM (8bit)
0.6953
8.0
0.8023
3.7%
0.0%
0.7793
KGW (zero-bit)
0.8652
25.9%
18.1% 1%
0.7745
KGW (multi-bit)
0.6381
4.46
0.8327
22.9%
6.3%
0,8123
KTH (zero-bit)
0.8919
61.4%
46.6%
0,8200
KTH (multi-bit)
0.6129
4.26
0.6775
10.9%
2.3%
0.8176
Waterfall(x 0.5)
0.7787
14.0%
3.8%
0,8499
Waterfall(s: = 1)
0.9392
62.4%
35.5%
0.8423
Ours
0.9563
5.57
0.9981
98.0 %
78.0%
0.8739
01 in our approach and paraphrase one text based on watermark code. This allows the multi-bir multi-bit information to be carried in the watermark.
addition, we also observe a higher similarity score com- pared to baseline methods. This might be surprising first glance. We owe it to the reason that we add a similarity reward during the PPO process, so that the model fine- tuned to achieve good paraphrasing performance.
Waterfall (Lau et al., 2024). They prompt a pretrained Llama model as the paraphraser and will change the sampling stage in order inject the watermark sig-
Multiple run In paraphrasing- watermark, we can run the paraphraser multiple times and return the result with best watermark detection rate. This method is adopted in previous methods (Zhang et al., 2024b; Lau et al., 2024). In this section, we evaluate how different methods im- prove with multiple runs the paraphraser. The results are shown Figure 2. We can observe that our methods can scale over 0.99 bit accuracy and 0.9999 detection AUC with five repeats of the paraphraser. Since small model which can be run in parallel efficiently, we view it as a good tradeoff to repeat five times and achieve a hetter watermark performance. Other methods also get performance boost with more repeats, but there is still a clear performance gap.
nal. Their extracted watermark code a permutation, which does not support bit- comparison. We eval- uate the watermark strength at к = 0.5 and = 1. Note that in their original paper, they use a strong wa- termark up to x = 8. However, in our evaluation, we observe that even A = will affect the paraphrasing performance significantly for the 1.1B small model. Therefore, use relatively small in the evalua- tion.
1.IB
Note that did compare with well-known text watermark they are already covered in previous works. We did not compare with AWT (Abdelnabi & Fritz, 2021) as RemarkLLM shows a better performance in their pa- per. We did not compare with Robust Multi-bit (Yoo et al., 2023) and NLW (Qiang et al., 2023) as Waterfall shows better performance in their paper. There are also many works (e.g. (Christ et al., 2024; Zhao et al., 2023)) that focus on LLM watermarks, but we only choose the repre- sentative ones (KGW and KTH).
Example and Analysis Stealthiness We show sev- eral examples of the watermarked text and their original version in Table 6 in Appendix B. The sentences of class O and class I are marked with blue and green respectively. All the sentences are correctly classified by the decoder. From our observation, is difficult to tell a significant dif- ference between the two classes of sentences, confirming the stealthiness of our watermark.
4.2. Performance
We show the watermark performance in Table 1. We can observe that our method achieves a better performance than existing methods on both bit-wise accuracy and text-wise accuracy. Our method also has high information density, with approximately one bit per tokens (128/5.57).
To further validate the stealthiness of our watermark, we prompt GPT with in-context learning to see if it can tell the difference between the two classes of sentences. Specifi- cally, we provide GPT with ten class-O and ten class-1 sen- tences, and ask it classify which class a new sentence
6

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
0.99
0.999
0.9999
0.999
TPR@FPR=
0.99
AUC
Bit
0.99
0.0
2
3
4
3
4
5
3
4
5
Number of Repeats
Number of Repeats
Number of Repeats
Ours
KTH (zero-bit)
RemarkLLM(bit=
KGW (zero-bit
KTH (multi-bit)
Waterfallkkappa=0055
KGW (multi-bit)
RemarkLLM(bit==)
Waterfal((kappa=1)
Figure 2. The detection performance of our watermark compared with baseline methods with multiple repeats of the paraphraser. Note that methods do support multi-hit watermark code, they do not have curve of bit accuracy the left figure.
Table 2. The performance of watermark compared with baseline methods under word substitution attack.
Substitute ratio 5%
Substitute ratio 10%
Substitute ratio 20%
Method
bitacc
AUC
TPR 1%
bitacc
AUC
TPR @
bitace
AUC
TPR 1%
RemarkLLM (4bit)
0.6118
0.6215
0.0%
0.6315
0.6441
0.0%
0.6488
0.6624
0.0
RemarkLLM (8bit)
0.5685
0.6281
0.6%
0.5783
0.6445
1.0%
0.5921
0.6665
0.8%
KGW (zero-bit)
0.8458
21.4%
0.8353
16.5%
0.7779
7.0%
KGW (multi-bit)
0.6208
0.8052
20.9%
0.6134
0.7914
18.9%
0.5840
0.7471
12.8%
KTH (zero-bit)
0.8718
56.5%
0.8541
51.8%
0.8128
41.5%
KTH (multi-bit)
0.6018
0.6574
9.0%
0.5955
0.6504
8.0%
0.5610
0.6120
5.1%
Waterfall(r: 0.5)
0.7578
12.5%
0.7344
9.1%
0.6893
5.3%
Waterfall(x 1)
0.9250
54.1%
0.9096
28.9%
0.8558
25.6%
Ours Ours(advt)
0.9382
0.9945
93.5%
0.9193
0.9871
86.4%
0.8605
0.9469
51.6%
0.9459
0.9958
94.1 1
0.9352
0.9936
91.6%
0.9138
0.9853
78.7% 7
belongs to. The detailed prompt is shown in Figure in Appendix A. evaluate 1,000 class-O and 1,000 class-1 I sentences, and the accuracy is 57.0%, which close to the performance of random guess (50.0%). Thus, conclude that our watermark is stealthy and it is difficuut to tell dif- ference between the two classes of sentences.
Word Substitution For paraphrasing attack, we will ran- domly substitute {5%, 10%, 20%) tokens in the text with another randomly chosen token (uniformly sampled from the vocabulary). We show the results in Table adversarial training model uses 10% of word substitution during the training process. We can observe that our orig- inal model can already outperform all the baselines when perturbed with word substitutions. With the knowledge of perturbation during the training process, we can further improve the performance and achieve over 0.99 detection AUC even when 10% of the tokens are randomly substi- tuted.
The
4.3. Robustness
In this section, study the robustness of our watermark. The evaluation pipeline follows the standard protocal we first generate watermarked text, then modify the text with text-level perturbations, and finally test whether we can still detect the watermark in the text. We will evaluate word substitution and sentence paraphrasing, which popular perturbations texts. In addition trained model, we also evaluate the adversarially trained model (denoted as Ours-AdvT), which has the knowledge of perturbation during training and will use the perturhed text when training the decoder.
Sentence Paraphrasing For sentence paraphrasing, we consider three types. Following (Lau et al., 2024), will translate the sentence to Spanish and then back to English with a Llama2-7B model, denoted as "Translate". We will also directly prompt Llama2-7B model to paraphrase the sentence, denoted as "LlamaPara". The detailed prompts used to do the translation and paraphrasing are shown in
most benign-
7

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Table 3. The performance of our watermark compared with haseline methods under sentence paraphrasing attack.
Translate
LlamaPara
PegasusPara
Method
bitace
AUC
TPR @ 1%
bitacc
AUC
TPR@ 1%
bitace
AUC
TPR @ %
RemarkLLM (4bit)
0.6885
0.7142
0.0%
0.7063
0.7311
0.0%
0.7033
0.7248
0.0%
L (8bit)
0.6124
0.6904
1.4%
0.6023
0.6751
1,5%
0.6018
0.6687
1.2%
KGW (zero-bit)
0.4872
0.2%
0.4872
0.2%
0.4900
0.0%
KGW (multi-bit)
0.4997
0.5829
1.6%
0.4765
0.5383
1.5%
0.4817
0.5654
1.5%
KTH (zcro-bit)
0.8600
30.6%
0.8559
32.0%
0.8618
43.7%
KTH (multi-bit)
0.4923
0.4990
0.8%
0.4952
0.4957
1.7%
0.4949
0.5025
1.3%
Waterfall(x 0.5)
0.604
4.0%
0.5833
1.9%
0.5981
5.0%
Waterfall(x = I)
0.7432
11.8%
0.6519
3.1%
0.7283
13.2%
Ours Ours(advt)
0.8206
0.9310
67. 37.4%
0.7137
0.8649
43,9 %
0.7388
0,8616
53.7% %
0.9003
0.9709
78.1%
0.8487
0.9239
36.8%
0.8648
0.9546
45.7%
Table 4. The performance of our watermark, trained on dataset, when evaluated texts collected in other tasks.
Bit-wise Accuracy
Text-wise Accuracy
Fidelity
Dataset
Bit Ace
Bit Num
AUC
TPR@FPR=1%
TPR OPR@FPR=0.010 %
Similarity
HH
0.9582
5,856
0.9991
97.9%
92.1%
0.8823
PKU
0.9613
5.325
0.9959
96.7%
1.8%
0.8923
Reward
0.9572
5.684
0.9962
96.7%
51.4%
0.8711
Utraa 0.9519
6.234
0.9931
94.5%
55.7%
0.8830
FineWeb 0.9461
6.066
0.9880
93.3%
19.3%
0.8463
Pile
0.9140
6.026
0.9713
83.8%
36.1%
0.8430
Figure and 6 in Appendix A. In addition, following (Xu al., 2024), we also paraphrase the sentence with the Pe- gasus (Zhang et al., 2020) paraphraser, denoted as "Pega- susPara".
4.4. Out-of-Distributionaa Tasks
As our pipeline relies on a data-driven training process, we would like to evaluate how it performs potential out-of-distribution data. In this section, we will eval- uate our model, previously trained on the C4 dataset, various other datasets, including Anthropic HH-RLHP (HH) (Bai et al., 2022), Synthetic instruction PKU SafeRLHF (PKU) (Ji et al., 2024), Reward?, UI- traFeedback (Cui al., 2024), FineWeb (Penedo et al., 2024) and Pile uncopyrighted((Ple)) datasets. Among the datasets, HH, Instruct, PKU, Reward and Ul- traF are QA datasets for alignment and we use their an- swers as the original texts. Fine is a dataset consisting of articles from the Internet. Pile is dataset consisting of cleaned texts from different sources.
The results are shown Table 3. We observe that all these text watermarking methods suffer from a significant per- formance drop under paraphrasing attacks. We owe to the reason that the text watermarks aim to preserve the text meaning and inject watermarks with other signals (e.g. wording choices stylish changes), while these signals will be easily broken by another paraphrasing process. As an extreme example, one may paraphrase the watermarked text into its original un m--terrmmarked version (because the watermarking process requires that both texts should have the same semantic meaning), and is impossible to detect the watermark from the text after perturbation (i.e. the orig- inal text). Nevertheless, is still possible to preserve part of the watermark signal under mild paraphrasing, such as translation. We can observe that our method can outper- form baselines on all the paraphrasing tasks, and can be further improved with adversarial training.
The performance of our model is shown in Table 4. We observe that model generally achieve good
hhtp:s/tiegiiiifeccccddassss/lss instruct- pair-ia http://wwnggiiiiocccooooosss/sts datasets
http://lwagnngggeccoooaaeeeeeenn uncopyrighted
8

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
synonym substitution other direct changes in the text. (Topkara al., 2006) proposes to add watermarks text by replacing the most ambiguous words with synonyms in a text. (Xiang et al., 2018) investigated the frequency of synonym words so that more bits can be injected with the frequency information. (Munyer et al., 2024) considers the Word2Vec embedding (Mikolov, 2013) in the synonym substitution so that more information can be injected. (Yoo et al., 2023) extracts invariant features from the text to sub- stitute synonyms so that the watermark can be more robust under different perturbations. More recently, people have studied how to directly inject watermark by paraphrasing the text. (Abdelnabi & Fritz, 2021) proposes a LSTM- based pipeline to paraphrase a text and inject a fixed num- ber of watermark bits. (Zhang et al., 2024b) improves the work by using Transformer-based pipeline and proposing to Gumbel softmax for token selection conditioned on the watermark code. (Lau et al., 2024) proposes to use an LLM-based paraphraser and inject watermarks in the per- mutations of n-gram information in the text.
Table 5. Performance of our watermark when varying regulariza- tion coefficients A. and Ax.
Coefficients
Bit Ace
AUC
Similarity
A-- = 5.0, A = 0.02
0.7606
0.9028
0.9728
A₂ 2.0, Aạ= 0.02
0.9525
0.9967
0.8961
A = 1.0, Aạ= = 0.02
0.9563
0.9981
0.8739
A 0.5, λạ= 0.02
0.9679
0.9988
0.8515
A = 0.2, Ax= = 0.02
0.9722
0.9987
0.8283
A = 1.0, A = 0.1
0,9036
0.9739
0.8878
A₂ 1.0, A = 0.05
0.9284
0.9849
0.8840
A = 1.0, A = 0.02
0.9563
0.9981
0.8739
A 1.0, A = 0.01
0.9799
0.9991
0.8529
A = 1.0, A = 0.005
0.9828
0.9991
0,8489
performance on different datasets, indicating its good gen- eralization capability. We do observe relatively weak per- formance on the Pile task, which we view as a result of the frequent structural texts (e.g. XML languages) in the dataset. Nevertheless, we emphasize that we can always include a new data domain in the training process, so that they become "in-domain" and can achieve a higher perfor- mance.
LLM Output Watermarks Besides text watermarking, there is also a line of research which studies the injec- tion of watermarks into LLMs, so that the output texts of LLM can be later detected. (Kirchenbauer et al., 2023) first proposes to watermark an LLM. They will increase the logits of certain random tokens, which are generated based on n-gram information. They then perform a sta- tistical test on the text to determine whether the token ap- pearance frequency is from the watermarked LLM. Follow- up works (Hou al., 2023; Liu et al., 2023) will gener- ate the random tokens based semantic meaning rather than n-gram information, which makes the watermark ro- bust against paraphrasing attacks. (Kuditipudi et al., 2023) adds perturbation during the sampling phase after the logits are generated, so that there is no distributional change on the output text. (Gu al., 2023) proposes to distill a wa- termarked model into new LLM model with changed pa- rameters, so that no special mechanism is required during inference. (Xu et al., 2024) proposes a co-training frame- work on the watermarked LLM and a watermark detector so that the detector is trained to detect the watermarked text and the LLM is finetuned to get easily detected. Unlike text watermarking, this line of work focuses purely on LLM- generated text.
4.5. Impact of Ag and Aạ
As discussed in Section 3.4, we use A, control the simi- larity reward regularization and d to control the KL diver- gence regularization in the process of paraphraser training. In this subsection, we study how these coefficients impact the final training performance. Specifically, we vary the co- efficients from their original choice X = 1.0, A = 0.02 and show the resulted detection performance and sentence similarity in Table 5. We can observe that X₂ and 2 in- deed control the trade-off between detectability and fidelity when we increase the coefficient, fidelity will be improved but the detectability will be decreased. Nevertheless, the performance is good for both aspects in most coefficient selections. We view our choice in the main experiments to have a moderate tradeoff between fidelity and detectabil- ity.
6. Conclusion
In this work, we propose multi-bit text watermark by paraphrasing piece of text to inject watermark signals. We show that our pipeline achieves very high detection ac- curacy with good fidelity and stealthiness. In addition, our method is robust under different attacks. Our method sheds new light on the study of text watermarks.
5. Related Works
Text Watermarks People have been studying text water- marks for a long time in order to protect copyrights (Liu et al., 2024). Early works on text watermarks focus on

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Impact Statement
els. In International Conference on Machine Learning, pp. 17061-17084, PMIR, 2023.
This paper proposes a method to inject a binary watermark code into piece of text. Our method can help with the problem of LLM-generated text tracking and human text copyright protection. However, it may also be applied in applications such as hidden message convey, where some- one encrypts the code into a text in a stealthy way.
Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P. Robust distortion free watermarks for language models. arXiv preprint arXiv:2307.1559. 2023.
Lau, G. K. R., Niu, X., Dao. H., Chen, J., Foo, C.- S., and Low, B. K. H. Waterfall: Framework for ro- bust and scalable text watermarking. arXiv preprint arXiv:2407.04411 2024.
References
Liu, A., Pan, L.,, Hu, X., Meng, S., and Wen, L. A semantic invariant robust watermark for large language models. arXiv preprint arXiv:2310.06356 2023.
Abdelnabi, and Fritz, M. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 202/ IEEE Symposium on Security and Pri- vacy (SP), pp. 121-140. IEEE, 2021.
Liu, A., Pan, L.,, Lu, Y., Li, J., Hu, X., Zhang, X., Wen, L., King, I., Xiong, H., and Yu, P. A survey of text wa- termarking in the era of large language models. ACM Computing Surveys, 2024.
Bai, Y., Jones, A., Ndousse, K., Askell, A., Chen, A., Das- Sarma, N., Drain, D., Fort, S., Ganguli, D., Henighan, T., et al. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint ar 2r4.022204.05862, 2022.
Mikolov, Efficient estimation of word representations in vector space. arXiv preprint arXiv: /301.378// 2013.
Christ, M., Gunn, S., and Zamir, O. Undetectable water- marks for language models. In The Thirty Seventh An- mual Conference on Learning Theory, pp. 1125-1139. PMLR, 2024.
Munyer, T., Tanvir, A., Das, A., and Zhong, X. Deep- textmark: A deep learning-driven text watermarking ap- proach for identifying large language model generated text. IEEE Access, 2024.
Cui, G., Yuan, L., Ding, N., Yao, G., He, B., Zhu, W., Ni, Y., Xie, G., Xie, R., Lin, Y., et al. Ultrafeedback: Boosting language models with scaled ai feedback. In Forty-first International Conference Machine Learn- ing, 2024.
Penedo, G., Kydlíček, H., allal, L. B., Lozhkov, A., Mitchell, M., Raffel, C., Werra, L. V., and Wolf, T. The fineweb datasets: Decanting the web for the finest text data at scale, 2024. URL https: /argxvv.rgg/
abs/2406. 17557.
Gu, C., Li, X. L., Liang, P., and Hashimoto, T. On the learnability of watermarks for language models. arXiv preprint arXiv:2312.04466 2023.
Qiang, J., Zhu, S., Li, Y., Zhu, Y., Yuan, Y. and Wu, X. Natural language watermarking via paraphraser-based lexical substitution. Artificial Intelligence, 317: 317:103859, 2023.
Hou, A. B., Zhang, J., He, T., Wang, Y., Chuang, Y.- S., Wang. H., Shen, L.. Van Durme, B., Khashabi, D., and Tsvetkov, Y. Semstamp: A semantic watermark with paraphrastic robustness for text generation. arXiv preprint 1tX.:233100039911111 2023.
Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., and Liu, P. J. Exploring the limits of transfer learning with unified text-to-text transformer. Journal of machine learning research, 21 (140):1-67, 2020.
Jaques, N., Ghandeharioun, A., Shen, J. H., Ferguson, C. Lapedriza, A., Jones, N., Gu, S., and Picard, Way off-policy batch deep reinforcement learning of implicit human preferences in dialog. arXiv preprint 004600 2019.
Schulman, J., Wolski, F., Dhariwal, P., Radford. A., and Klimov, O. Proximal policy optimization algorithms. arXiv preprint arXiv: 2017.
Topkara, U., Topkara, M., and Atallah, M. J. The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions. In Proceedings of the 8th workshop Multimedia and security, pp. 164-174, 2006.
Ji, J., Hong, D., Zhang, B., Chen, B., Dai, J., Zheng, B., Qiu, T., Li, B., and Yang, Y. Pku-saferlhf: Towards multi-level safety alignment for Imms with human pref- erence. arXiv preprint arXiv:2406.1551. 2024.
Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I. and Goldstein, watermark for large language mod-
Xiang, L., Li, Y., Hao, W., Yang, P., and Shen, X. Re- versible natural language watermarking using synonym
10

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
substitution and arithmetic coding. Computers, Materi- als Continua, 55(3), 2018.
Xu, X., Yao, Y, and Liu, Y. Learning to watermark 1lm- generated text via reinforcement learning. arXiv preprint vrXiv:2403.10553 2024.
Yoo, K., Ahn, W., Jang, J., and Kwak, N. Robust multi- bit natural language watermarking through invariant fea- tures. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguisties (Volume 1; Long Papers), pp. 2092-2115, 2023.
Zhang, J., Zhao, Y., Saleh, M., and Liu, P. Pegasus: Pre-training with extracted gap-sentences for abstractive summarization. In International conference on machine learning, pp. 11328-11339 PMLR, 2020.
Zhang, P., Zeng, G., Wang, T., and Lu, W. Tinyllama: An open-source small language model, 2024a.
Zhang. R., Hussain, S. S., Neekhara, P., and Koushanfar, F. [REMARK-LLM) A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pp.
1813-1830, 2024b.
Zhao, X., Ananth, P., Li, L., and Wang, Y.-X. Provable ro- bust watermarking for ai-generated text. arXiv preprint 2rXvv:2306.17433 2023.
Zheng, R., Dou, S., Gao, S., Hua, Y., Shen, W., Wang, B., Liu, Y., Jin, S., Liu, Q., Zhou, Y., et al. Secrets of rlhf in large language models part i: Ppo. arXiv preprint 27X14:2307.0496, 2023.

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
A. Prompts Used in the Experiments
We show the detailed prompts used in the experiments as below:
Figure 3:
prompt used in the encoder.
Figure prompt used do in-context classification with GPT.
Figure 5: prompt used to translate text with Llama-2-7B.
Figure 6: prompt used to paraphrase text with Llama-2-7B
We did make special efforts optimize these prompts.
Human: Paraphrase the text below.
(Original Text]
Assistant: Paraphrased Text:
Figure 3. The prompt used to paraphrase the text in the encoder.
I have two classes of text, C1 and c2, which have intrinsic difference. will provide you with lists of texts from bothclasses. Can you help me classify which class new text is in? You answer should only contain one word, [C1] or [C2].
C1 texts:
(Class-O sentences)
C2 texts: (Class-1 sentences)
New text: (The new sentence to classify)
Please answer Cl or C2.
Figure 4. The prompt used performance in-context classification of our watermarked text with GPT.
[
] <<SY>>> Translate the provided piece of text to (language). Do not include any other sentences after the response, such as explanations of the translation.


(text) 

Here is translated version of the text:
Figure 5. The prompt used to evaluate the watermark robustness under translation.
B. Examples of Watermarked Texts
We show the watermarked texts generated by our pipeline in Table Blue and green texts correspond class-O and class-1 texts respectively. We view it difficult to tell difference between the two classes of texts from human eyes.
C. Experiments on Llama-2-7B Models
We show the results of using Llama-2-7B model as the paraphraser in Table 7. Note that the RemarkLLM method does not support Llama models, so we do not evaluate the method; the Waterfall method on 7B models can support a larger s,
12

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
Table 6. Examples watermarked texts. Blue green texts correspond to class-O and class-1 texts respectively.
Original Text
Watermarked Text
Similarity
"When it comes to fantasy sports and betting on NASCAR races, there's nothing wrong with it," Gaughan said. "I wanted go all in on gambling last year," NASCAR executive Steve O'Donnell said. "We have many people that are linked to the cars. I think the integrity is big piece to it," O'Donnell said. Nevada's 's effective monopoly on sports betting ended last spring, when the Supreme Court ruled the ban should be
"There's nothing wrong with fantasy sports and bet- ting on NASCAR races," Gaughan said. Steve said I wanted to go all in on gambling last year. "We have so many people that linked to the cars," O' O'Donnell said. The integrity of the car is big piece to it because they are linked to it. Nevada's 's effective monopoly on sports betting ended last spring, as the Supreme Court ruled that the ban should be
0.9177
President Trump's decision Monday to revive plans to freeze federal employee pay in 2020 and to institute a series of cuts to federal employee retirement pro- grams was met with great consternation from stake- holder groups, although the ideas stand little chance of becoming law. Increasing employee contributions toward federal defined benefit annuity programs by percent per year until those payments reach 50 per- cent of the total cost. Eliminating cost of living ad- justments for FERS retirees, and reducing CSRS cost of living adjustments by 0.5 percent.
President Trump's decision Monday to resume plans to freeze federal employee pay and to cut retirement benefits for federal employees generated consterna- tion from stakeholder groups, despite having little hope of becoming law. The employee contributions the annuity programs up by 1 percent year un- til they reach five percent of the total cost. There cost of living adjustments for FERS retirees and cost adjustments for COLA, which are reduced by 0.5 per- cent.
0.8947
Bob "Bus Bob" Krause, 59, of Waikiki, Oahu Tran- sit System bus driver, died at home. He was born in Bremen, Germany. He is survived by parents Hans Krause and Sonja Aiwohi, brother Ralph and sisters Lorraine Kinnamon and Charmaine Moniz. Celebra- tion of life: 2 p.m. Friday at Outrigger Canoe Club Waikiki. Additional celebration of life: 4:30 p.m. on weekend of May and at K
Bob "Bus Bob" Krause, the head driver of the Oahu Transit System, died at home. His parents lived in Germany when he was born. He has surviving rela- tives, including his mother, sister, and brother. The celebration of life on Friday at the outrigger canoe club. There is celebration of life on Friday, May and at K
0.8743
Occasional diarrhea a common occurrence. Most people will experience an episode of diarrhea least once or twice year that will disappear in a couple of days. Luckily, there many foods to that may help person reduce the symptoms of diarrhea. There are also some foods to avoid when dealing with a bout of diarrhea, and some additional home care tips to consider. Anyone who is experiencing persistent diarrhea should see a doctor, as a person may become dehydrated over time.
Occasional diarrhea is a common occurrence. People will get sick more often than they used to do. There are many foods to eat that may help person reduce the symptoms of diarrhea. A lot of people avoid foods when they are dealing with bout of diarrhea and few home care ideas to consider are worth checking out. Anyone who is suffering from persistent diarrhea should see a doctor, as a person may become dehy- drated over time.
0.8392
13

---

Robust Multi-bit Text Watermark with LLM-based Paraphrasers
[
] <<SY>>> Paraphrase the provided text while preserving semantic similarity Do not include any other sentences in the response, such explanations of the paraphrasing. Do not summarize. 

(text) 

Here is paraphrased version of the text:
Figure 6. The prompt used evaluate the watermark robustness under Llama paraphrasing.
Table 7. The performance of our watermark compared with baseline methods with the Llama-2-77 model.
Bit-wise Accuracy
Text-wise Accuracy
Fidelity
Method
Bit Ace
Bit Num
AUC
TPR @ FPR=1% %
TPR TPR@FPR=0.0199 %
Similarity
KGW (zero-bit)
0.8625
24.4%
13.7%
0.8842
KGW (multi-bit)
0.6302
5.17
0.8498
15.2%
8.3%
0.8986
KTH (zero-bit)
0.8735
26.5%
12.5%
0.9075
KTH (multi-bit)
0.5756
5,075
0.7296
13.3%
2.0%
0.9073
Waterfall(x: = 1)
0.7568
13.3%
3.7%
0.8809
Waterfall(x: 2)
0.9213
49.3%
26.9%
0.8743
Waterfall(x= = 4)
0.9951
96.3%
89.8%
0.8350
Ours
0.9605
5.874
0.9973
97.6%
77.6%
0.8631
so we included results of k = 1, in the table. We can observe that our model keeps high performance with the 7B models. We do not see an improvement compared with the 1.1B models, which we guess because that fine-tuned 1.1B models already have the capability to paraphrase texts, so that a larger model may not help. methods can have better fidelity with the larger model. The Waterfall methods are able to larger K to inject strong watermarks, and the strongest case achieve comparable performance with our model, though there would be drop the fidelity.
other hand, baseline
14


Reviews:
[{"review_id": "7DFRy0lPf1", "reviewer": "Reviewer_yNYD", "summary": "The authors proposed a multi-bit text watermark by paraphrasing a piece of text to inject watermark signals. The watermark consists of an encoder-decoder pair. The encoder is fine-tuned to generate text that is classified by the decoder. The decoder is trained with a classification loss to better classify between bit-0 texts and bit-1 texts.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Different Segmentor** (The text segmentor simply consider each sentence in the text as a segment. Are there other better segment strategies?)\n\n**Response**: We agree with the reviewer that we use a simple segment strategy which splits text by sentences. Nevertheless, we argue that our current strategy is an effective choice, since the segmentation will be robust under word substitution and paraphrasing. To compare the performance of different segment strategies, we conduct an extra ablation experiment. We segment the text every 20 tokens and show the result in the table below. We can observe that the segment-by-token strategy also works well under normal scenario and substitution attacks. However, the performance significantly drops under translation attacks. This is because the token order will be changed after being translated back and forth, so that the segmentation of the perturbed watermarked text ($\\mathcal{S}(pert(x^w))$) will be different from that of the watermarked text ($\\mathcal{S}(x^w)$). As discussed in Section 6, we view the investigation of other segment strategies as an important future direction.\n\n| Task | bitacc | AUC | TPR@1% | Similarity |\n| :---- | ----: | ----: | ----: | ----: |\n| Ours, segment-every-20-tokens | 0.9507 | **0.9987** | **98.6%** | 0.8667 |\n| Ours, segment-by-sentence (original) | **0.9563** | 0.9981 | 98.0% | **0.8739** |\n\n| Task | bitacc | AUC | TPR@1% | \n| :---- | ----: | ----: | ----: |\n| Ours, segment-every-20-tokens, under substitution (10%) | **0.9242** | **0.9917** | **90.1%** |\n| Ours, segment-by-sentence (original), under substitution (10%) | 0.9193 | 0.9871 | 86.4% |\n| Ours, segment-every-20-tokens, under translation | 0.6015 | 0.6835 | 1.8% |\n| Ours, segment-by-sentence (original), under translation | **0.8206** | **0.9310** | **67.4%** |\n\n**Other evaluation metrics** (The authors consider similarity etc. as evaluation metrics to evaluate the watermarked texts. Are there other evaluation metrics that can be taken for evaluation purpose?)\n\n**Response**: We thank the reviewer for bringing out the question of metric design. We use three types of metrics to evaluate the watermarked texts - the bit-wise accuracy, the text-wise accuracy and the fidelity. These three metrics are the most commonly used metrics in the related works (e.g. RemarkLLM, Waterfall). We welcome suggestions on other metrics that could be helpful to evaluate the watermark performance.\n\n**Computation** (How good is the proposed watermarking in terms of avoiding additional computational burden?)  \n\n**Response**: Our model, similar to other text watermark methods like RemarkLLM and Waterfall, uses a LLM-based paraphraser to inject watermarks into text. The main runtime overhead is the time required to run the LLM-based paraphraser. To reduce computational burden, we use two small models (1.1B) and show that we can achieve good paraphrasing performance. By comparison, the Waterfall approach runs a 13B model. Nevertheless, we notice that the earlier RemarkLLM work uses the T5 model, which is a smaller 220M model. We hypothesize that such a small model may lead to a relatively lower paraphrasing performance. As shown in Table 1 in our paper, their similarity score is around 0.8 while ours can achieve >0.87.\n\nIn addition, we show the average time to run one watermark injection process in the table below. Surprisingly, the runtime of our method and RemarkLLM (for which we use their open-sourced implementation) is roughly the same. We owe it to the reason that current LLM packages, e.g. Huggingface Transformers, have better optimization for more recent models like Llama.\n\n| Method | # Parameters | Average Runtime (sec) |\n| :---- | ----: | ----: | \n| RemarkLLM | 220M (T5) | 1.13 |\n| Waterfall | 13B (Llama) | 7.92 |\n| Ours | 1.1B*2 (TinyLlama) | 1.23 |\n\n**Open-sourcing** (The authors are encouraged to make the source code of the proposed model publicly available such that the experimental results are convincing to other researchers.)\n\n**Response**: We thank the reviewer for pointing out the necessity of open-sourcing. We do have an open-source plan and promise to release the code of our work if the paper is accepted.\n\n**Original model Parameters** (Does the proposed watermark method change the parameter of the original LLM?)\n\n**Response**: As a clarification, we will have two different classes of LLMs in our pipeline. First, for the watermark injection, we will have \"paraphrasing LLMs\" to paraphrase the text to inject the watermark. The parameters of these paraphrasing LLMs are finetuned so that they can be used to inject watermark signals. Second, as a text watermark is often applied to watermark LLM-generated texts, we will apply our watermark method to texts that are generated by a \"source LLM\". We hypothesize that the reviewer is referring to this source LLM, whose parameters will not be changed in our watermark algorithm.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Are there any other evaluation metrics to evaluate the performance of the watermarking texts?", "theoretical_claims": "Yes.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "Other researchers working on LLMs may be interested in the topic of this paper.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "Strengths of the paper:\n1. The paper is well-written and easy to follow.\n2. The problem is of great value to investigate.\n3. Overview of the proposed model is provided in the figure.\n\nWeaknesses of the paper:\n1. The text segmentor simply consider each sentence in the text as a segment. Are there other better segment strategies?\n2. The authors consider similarity etc. as evaluation metrics to evaluate the watermarked texts. Are there other evaluation metrics that can be taken for evaluation purpose?\n3. How good is the proposed watermarking in terms of avoiding additional computational burden?\n4. The authors are encouraged to make the source code of the proposed model publicly available such that the experimental results are convincing to other researchers.\n5. Does the proposed watermark method change the parameter of the original LLM? If yes, how does the change of the parameters affect the performance of the original LLM?", "other_comments_or_suggestions": "No.", "questions_for_authors": "Please see the above weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "d867B1dZQJ", "reviewer": "Reviewer_E75M", "summary": "The paper presents a robust multi-bit text watermarking method that leverages LLM-based paraphrasers to embed imperceptible watermark signals into text while maintaining semantic fidelity. The approach involves fine-tuning a pair of paraphrasers designed to generate text variations that encode a predefined binary watermark at the sentence level. A trained LLM-based text classifier is then used as a decoder to retrieve the watermark from the modified text. The method employs a co-training framework using Proximal Policy Optimization (PPO), where the encoder (paraphraser) and decoder (classifier) are trained iteratively to optimize watermark embedding and extraction.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Ablation Study** (The method's performance is highly reliant on model initialization and carefully chosen hyperparameters (e.g., λw, λs, λk). To what extent do these hyperparameters influence the effectiveness of the approach?)\n\n**Response**: We agree with the reviewer that the hyperparameter choices are important to the performance of our pipeline. To evaluate their impact, we conduct ablation studies that fix $\\lambda_w$ and change the other two coefficients. The results are shown in the tables below. We can observe that $\\lambda_s$ and $\\lambda_k$ indeed control the trade-off between detectability and fidelity - the larger these coefficients, the better the paraphrasing performance but the worse the watermark detectability. Nevertheless, we argue that in most cases, performance is good for both detectability and fidelity.\n\n| Task | bitAcc | AUC | Similarity |\n| :---- | ----: | ----: | ----: |\n| $\\lambda_s$=5.0 | 0.7606 | 0.9028 | **0.9728** |\n| $\\lambda_s$=2.0 | 0.9525 | 0.9967 | 0.8961 |\n| $\\lambda_s$=1.0 (original) | 0.9563 | 0.9981 | 0.8739 |\n| $\\lambda_s$=0.5 | 0.9678 | **0.9988** | 0.8515 |\n| $\\lambda_s$=0.2 | **0.9722** | 0.9987 | 0.8283 |\n\n| Task | bitAcc | AUC | Similarity |\n| :---- | ----: | ----: | ----: |\n| $\\lambda_k$=0.1 | 0.9036 | 0.9739 | **0.8878** |\n| $\\lambda_k$=0.05 | 0.9284 | 0.9849 | 0.8840 |\n| $\\lambda_k$=0.02 (original) | 0.9563 | 0.9981 | 0.8739 |\n| $\\lambda_k$=0.01 | 0.9799 | **0.9991** | 0.8529 |\n| $\\lambda_k$=0.005 | **0.9828** | **0.9991** | 0.8489 |\n\n**Larger Model** (Could you discuss on why larger models, like Llama-2-7B, show only marginal performance improvements?)\n\n**Response**: We owe it to the reason that the paraphrasing task is a relatively easy task so that small models can be fine-tuned to achieve good performance. For example, although the PEGASUS paraphrasing model was proposed in 2020 and has less than 600M parameters, it has good paraphrasing performance and is still widely used in current paraphrasing tasks. With the similarity reward included during our RL process, our 1.1B models are fine-tuned to be good paraphrasers. Therefore, using larger models may only provide marginal improvements.\n\n**Adaptive Attacks** (How can the proposed watermarking method effectively defend such adaptive attacks?)\n\n**Response**: We thank the reviewer for pointing out the possibility of adaptive attacks. We can think of two possibilities of adaptive attacks. First, the adversary can attack the detection model with adversarial ML techniques, which aims to slightly change the text so that the detection model output is greatly changed. For this attack, we argue that the detection model parameters will be kept private to the watermark provider and not available by the adversary. Therefore, this is a black-box adversarial attack on LLM-based detectors which, as far as we can tell, does not have a well recognized attack method that works well. We welcome suggestions on potential attacks against our watermark detector under the black-box setting.\n\nAnother possibility of adaptive attack is to hack the text segmentation process. For example, knowing that our watermark is segmented based on sentences, the adversary may try to insert or delete sentences so that the watermark code cannot be recognized. That is to say, suppose the text is assigned watermark code 1010110, the adversary can delete the second sentence to make it 110110, and thus the matching rate between the ground truth and decoded code will be low (only 2 bits are matched). To mitigate this exact problem, we may use the longest common sequence algorithm to calculate the match rate (in this case, 5 bits will be matched). In general, we argue that the segmentation method can also be varied and kept private, thus reducing the problem of being hacked. For example, in the response to Reviewer ZSdw and yNYD, we show that we may also segment the text by every 20 tokens, and also achieve a good watermark performance.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "The paper proposes a Robust Multi-bit Text Watermark.", "essential_references_not_discussed": "Yes", "other_strengths_and_weaknesses": "Strength\n- Unlike traditional watermarking approaches that rely on lexical substitutions, this method leverages paraphrasing, providing a larger action space for embedding watermarks while maintaining naturalness in generated text.\n- The proposed watermarking method achieves over 99.99% detection AUC, outperforming existing techniques.\n\nWeakness\n\n- The method's performance is highly reliant on model initialization and carefully chosen hyperparameters (e.g., λw, λs, λk). To what extent do these hyperparameters influence the effectiveness of the approach? This dependency raises concerns regarding the method's reproducibility and its robustness when applied to different datasets or scaled-up models.  \n\n- The experiments primarily use relatively small models, such as TinyLlama-1.1B. Could you discuss on why larger models, like Llama-2-7B, show only marginal performance improvements?  \n\n- If the watermarking technique becomes publicly available, an attacker could develop an adaptive strategy specifically designed for the watermarking process. How can the proposed watermarking method effectively defend such adaptive attacks?", "other_comments_or_suggestions": "See the Weakness", "questions_for_authors": "See the Weakness", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TLVvqIIsi7", "reviewer": "Reviewer_ZSdw", "summary": "The paper proposes a method for injecting watermarks to text. The key idea proposed is to use two LLM paraphrasers (one for the '0' bit \nand one for the '1' bit). The decoder (classifier) and the paraphrasers are trained together in a co-training setup. The results achieved are impressive, achieving 99.9% AUC and 95% bit accuracy while using relatively small (1.1B) models. The authors also conduct robustness checks by perturbing the text and show that their method outperforms other baselines in the presence of word substitution and sentence paraphrasing attacks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Different Segmentation** (what is the impact of using a different segmentation method?)  \n\n**Response**:  To compare the performance of different segmentation strategies, we conduct an extra experiment in which we design a \"segment-by-token\" strategy, where we segment the text every 20 tokens and show the result in the table below. We can observe that the segment-by-token strategy also works well under normal scenario and substitution attacks. However, the performance significantly drops under translation attacks. This is because the token order will be changed after being translated back and forth, so that the segmentation of the perturbed watermarked text ($\\mathcal{S}(pert(x^w))$) will be different from that of the watermarked text ($\\mathcal{S}(x^w)$). This also explains why we choose our current segmentation strategy - it is generally robust under both word substitution and parapharsing. As discussed in Section 6, we view the investigation of other segmentation strategies as an important future work.\n\n| Task | bitacc | AUC | TPR@1% | Similarity\n| :---- | ----: | ----: | ----: | ----: |\n| Ours, segment-every-20-tokens | 0.9507 | **0.9987** | **98.6%** | 0.8667 |\n| Ours, segment-by-sentence (original) | **0.9563** | 0.9981 | 98.0% | **0.8739** |\n\n| Task | bitacc | AUC | TPR@1% |\n| :---- | ----: | ----: | ----: |\n| Ours, segment-every-20-tokens, under substitution (10%) | **0.9242** | **0.9917** | **90.1%** |\n| Ours, segment-by-sentence (original), under substitution (10%) | 0.9193 | 0.9871 | 86.4% |\n| Ours, segment-every-20-tokens, under translation | 0.6015 | 0.6835 | 1.8% |\n| Ours, segment-by-sentence (original), under translation | **0.8206** | **0.9310** | **67.4%** |\n\n**Different length of text** (There are no studies on the length of the text, i.e how is the performance when dealing with small texts vs large documents.)\n\n**Response**: We thank the reviewer for pointing out the necessity to do ablation studies on input text length. We perform the experiment of varying input text length and show the results in the table below, where \"len\" refers to the number of tokens in the input text. We can observe that the bit-wise accuracy keeps similar, while the text-wise detection AUC grows as the input length grows. This is expected, as longer text (and thus a longer watermark code) will provide better error tolerance for detection. Interestingly, paraphrasing similarity also grows with longer text. This is probably due to the fact that shorter sentences have less possibilities of being changed, so that the paraphrasers need to do more changes in order to inject watermarks.\n\n| Task | bitAcc | AUC | Similarity |\n| :---- | ----: | ----: | ----: |\n| len=16 | 0.9417 | 0.8133 |  0.7639 |\n| len=32 | 0.9463 | 0.8908 | 0.8064 |\n| len=64 | 0.9521 | 0.9698 |  0.8396 |\n| len=128 (original) | 0.9563 | 0.9981 | 0.8739 |\n\n**Computation Overhead** (There are no analysis on the computational overload compared to other baselines, considering we use two llms.)\n\n**Response**: Our model, similar to other text watermark methods like RemarkLLM and Waterfall, uses a LLM-based paraphraser to inject watermarks into text. The main computation is the time required to run the LLM-based paraphraser, where we use two small models (1.1B). Since we need to do forward pass for two models, the runtime is approximately similar to that of running a 2.2B model. By comparison, the Waterfall approach runs a 13B model. The earlier RemarkLLM work uses the T5 model, which is a smaller 220M model. We hypothesize that such a small model may lead to a relatively lower paraphrasing performance. As shown in Table 1 in our paper, their similarity score is around 0.8 while ours can achieve >0.87. In addition, we show the average time to run one watermark injection process in the table below. Surprisingly, the runtime of our method and RemarkLLM (for which we use their open-source implementation) is roughly the same. We owe it to the reason that current LLM packages, e.g. Huggingface Transformers, have better optimization for more recent models like Llama.\n\n| Method | # Parameters | Average Runtime (sec) |\n| :---- | ----: | ----: | \n| RemarkLLM | 220M (T5) | 1.13 |\n| Waterfall | 13B (Llama) | 7.92 |\n| Ours | 1.1B*2 (TinyLlama) | 1.23 |", "claims_and_evidence": "The key claims on the performance of their framework are well-supported by the experimental evidence provided. Specifically, the authors claim their framework achieves high watermark detection performance (table 1), is robust to word substitution and paraphrasing attacks (tables 2 and 3) and generalizes to out of distribution data (Appendix B).", "methods_and_evaluation_criteria": "The evaluation criteria of using AUC and robustness checks make sense for this problem.", "theoretical_claims": "The paper does not have any theoretical claims.", "experimental_designs_or_analyses": "Overall, the experimental design and analyses are sound. The authors evaluate on multiple datasets, compare against appropriate baselines, and test different perturbation attacks. \nThe stealthiness claims are a bit weak, as there is no subjective evaluation performed large scale by human participants. Instead the authors use a GPT based model to check.", "relation_to_broader_scientific_literature": "The existing literature could be classified to pre-LLM based watermarks and LLM based watermarks. The contributions of the paper fall under LLM based text watermarking. Within this category, there are three key works: Remark LLM that uses LLM paraphrasers, KGW and KTH that add watermarks during token generation, making it unsuitable for non LLM generated text. Although LLM based watermarking was explored before, this paper shows that having two LLM paraphrasers, trained in a co-training setup can perform better than the other methods in terms of performance and robustness check.", "essential_references_not_discussed": "I was not able to find papers that were not cited.", "other_strengths_and_weaknesses": "Strengths:\n1. The authors propose a novel approach of having LLM phrasers for each bit and training them together in a co-training framework.\n2. They show strong empirical results on detection accuracy and robustness on multiple datasets. They also compare their work against relevant baselines to show improvement.\n3. The paper is well-written and structured.\n\nWeakness:\n1. There are no ablation studies on the choice of sentence segmentation. I understand that it was an assumption, but what is the impact of using a different segmentation method? \n2. There are no studies on the length of the text, i.e how is the performance when dealing with small texts vs large documents. \n3. There are no analysis on the computational overload compared to other baselines, considering we use two llms.", "other_comments_or_suggestions": "The paper is well written, the claims would be strong if there are ablation studies on length of text, choice of text segmentation and computational analysis.", "questions_for_authors": "I put my questions in the weakness section above. Specifically, my questions are related to how the performance and robustness of this method is for texts of varying length. Also how is the choice of text segmentation affecting the performance.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OCo02IH03h", "reviewer": "Reviewer_3TNX", "summary": "The paper introduces methodologies for embedding imperceptible multi-bit text watermarks. The proposed algorithm aims to fine-tune a pair of LLM paraphrasers that are designed to behave differently so that their paraphrasing difference reflected in the text semantics can be identified by a trained decoder. The effectiveness of the proposed method is demonstrated through extensive experiments.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Ablation study of similarity reward** (Lack of ablation experiments to show the effectiveness of the similarity reward rs in Equation 4. ... If a larger model is used, such as Llama-2-7b, is the similarity reward rs in Equation 4 still needed?)\n\n**Response**: We show the effect of similarity reward $r_s$ with an ablation study on its coefficient $\\lambda_s$, as well as another ablation study on $\\lambda_k$ which controls the weight of the KL divergence term. The result is shown in the table below. We can observe that $\\lambda_s$ and $\\lambda_k$ indeed controls the trade-off between detectability and fidelity - when we increase the coefficient, fidelity will be improved but the detectability will be decreased. This shows that the similarity reward $r_s$ is important in training a high-performance paraphraser.\n\nRegarding the second question of whether $r_s$ is still needed for larger models, we argue that it is still essential in order to preserve good paraphrasing performance. This is because if we only train the model with watermark loss, its paraphrasing ability will be decreased during the training process. Therefore, we still need the similarity reward to maintain its performance.\n\n| Task | bitAcc | AUC | Similarity |\n| :---- | ----: | ----: | ----: |\n| $\\lambda_s$=5.0 | 0.7606 | 0.9028 | **0.9728** |\n| $\\lambda_s$=2.0 | 0.9525 | 0.9967 | 0.8961 |\n| $\\lambda_s$=1.0 (original) | 0.9563 | 0.9981 | 0.8739 |\n| $\\lambda_s$=0.5 | 0.9678 | **0.9988** | 0.8515 |\n| $\\lambda_s$=0.2 | **0.9722** | 0.9987 | 0.8283 |\n\n| Task | bitAcc | AUC | Similarity |\n| :---- | ----: | ----: | ----: |\n| $\\lambda_k$=0.1 | 0.9036 | 0.9739 | **0.8878** |\n| $\\lambda_k$=0.05 | 0.9284 | 0.9849 | 0.8840 |\n| $\\lambda_k$=0.02 (original) | 0.9563 | 0.9981 | 0.8739 |\n| $\\lambda_k$=0.01 | 0.9799 | **0.9991** | 0.8529 |\n| $\\lambda_k$=0.005 | **0.9828** | **0.9991** | 0.8489 |\n\n**Clarification on metrics** (In the experimental metrics, how do you determine a text is watermarked (the extracted multi-bit watermark is consistent with the injected multi-bit watermark? Or most of bits in the extracted multi-bit watermark are correct).)\n\n**Response**: We are sorry for the confusion here. We will determine whether a text is watermarked by checking the proportion of the extracted watermark bits that match the injected bits. For example, if 90% of the bits match, then the text is watermarked. Note that the threshold (90% in the example) is not a fixed value but will be changed in order to calculate AUC and TPR@FPR=x. We will clarify the metric computation in the revision of our paper.\n\n**Writing** (The first occurrence of an abbreviation should be given in full (e.g., LLM in Abstract).)\n\n**Response**: We thank the reviewer for pointing out the writing issues. We will fix them in the revision of the paper.", "claims_and_evidence": "The claims are supported by clear evidence.", "methods_and_evaluation_criteria": "Methods: The co-training framework (encoder-decoder with PPO-based RL) is novel and appropriate for aligning watermark injection and detection. Sentence-level segmentation simplifies multi-bit encoding.\n\nEvaluation: Metrics (bit accuracy, AUC, similarity scores) are well-chosen. Baselines (RemarkLLM, KGW, KTH, Waterfall) cover representative works.", "theoretical_claims": "No explicit theoretical proofs are provided.", "experimental_designs_or_analyses": "Missing ablation study. For example, does the similarity reward $r_s$ (Equation 4) remain critical when using larger models (e.g., Llama-2-7B)?", "relation_to_broader_scientific_literature": "The work builds on paraphrasing-based watermarks. It uses PPO-based RL techniques to finetune the encoder so that the injected watermark can be better decoded.", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "Strengths:\n\nThe presentation is clear and easy to follow. The authors explain the proposed algorithm clearly.\n\nThe performance on several datasets shows the effectiveness of the proposed algorithm.\n\nWeakness:\n\nLack of ablation experiments to show the effectiveness of the similarity reward $r_s$ in Equation 4. \n\nSome experimental details are not clearly described. In the experimental metrics, how do you determine a text is watermarked (the extracted multi-bit watermark is consistent with the injected multi-bit watermark? Or most of bits in the extracted multi-bit watermark are correct).", "other_comments_or_suggestions": "The first occurrence of an abbreviation should be given in full (e.g., LLM in Abstract).", "questions_for_authors": "If a larger model is used, such as Llama-2-7b, is the similarity reward $r_s$ in Equation 4 still needed?\n\nIn the experiment, during the calculation of TPR@FPR=1%, how to determine whether a text is the watermarked text based on the extracted multi-bit watermark information?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper introduces Robust Multi-bit Text Watermarking using dual LLM-based paraphrasers and PPO-based co-training, achieving >99.99% AUC and high robustness under attacks. Reviewers' concerns on segmentation, efficiency, and adaptivity were addressed with strong ablations. The AC thus recommends acceptance of the paper. Human evaluation and broader reproducibility analysis remain areas for future improvement.
Decision: Accept (poster)