GaussMark: A Practical Approach for Structural Watermarking of Language Models
Authors: Adam Block
Alexander Rakhlin
Ayush Sekhari
Venue: ICML 2025 poster (2025)
Keywords: Watermarking
Trustworthy ML
Language Models
Primary area: theory->everything_else
TL;DR: We introduce a practical and statistically valid watermarking scheme, provide theoretical guarantees, and empirically evaluate our scheme.Ω

Abstract: Watermarking, the process by which Large Language Model (LLM) servers imbed an imperceptible signal at inference time in order to detect text generated by their own models, has grown in importance due to the significant improvements in natural language processing tasks by modern LLMs. Current approaches are often impractical due to generation latency, detection time, degradation in text quality, or robustness; such problems often arise due to the focus on token level watermarking, which ignores the inherent structure of text. In this work, we introduce a new scheme, GaussMark, that is simple and efficient to implement, has formal statistical guarantees, comes at no cost in generation latency, and embeds the watermark into the weights of the model itself, providing a structural watermark. Our approach is based on Gaussian independence testing and is motivated by recent empirical observations that minor additive corruptions to LLM weights can result in models of identical (or even improved) quality. We provide formal statistical bounds on the validity and power of our procedure and, through an extensive suite of experiments, demonstrate that GaussMark is reliable, efficient, relatively robust to corruption, and can be instantiated with essentially no loss in model quality.

GaussMark: A Practical Approach for Structural Watermarking of Language Models
Adam Block 12 Alexander Rakhlin
Ayush Sekhari 34
Abstract
quality artificial text (Achiam et al., 2023; Schulman et al., 2022). While LLMs provide many benefits (He- Hue-Yueya et al., 2023; Ahn et al., 2024; Jiang et al., 2024; Imani et al., 2023; Wang et al., 2023), their rapid evolution and widespread deployment pose significant risks to social, political, and economic institutions (Mirsky et al., 2023). In particular, the ability of LLMs to produce human-like text has raised concerns about potential misuse, including academic pla- giarism (Kasneci et al., 2023) and the spread of tailored misinformation (Islam et al., 2020).
Watermarking, the process by which Large Lan- guage Model (LLM) servers imbed an impercep- tible signal at inference time in order to detect text generated by their own models, has grown in importance due to the significant improvements in natural language processing tasks by modern LLMs. Current approaches are often impractical due to generation latency, detection time, degra- dation in text quality, robustness; such prob- lems often arise due to the focus on token-level watermarking, which ignores the inherent struc- ture of text. In this work, we introduce new scheme, GaussMark, that is simple and efficient to implement, has formal statistical guarantees, comes no cost in generation latency, and em- beds the watermark into the weights of the model itself, providing structural watermark. Our ap- proach is based on Gaussian independence test- ing and is motivated by recent empirical obser- vations that minor additive corruptions to LLM weights can result in models of identical (or even improved) quality. We provide formal statistical bounds on the validity and power of our procedure and, through extensive suite of experiments, demonstrate that GaussMark is reliable, efficient, relatively robust to corruption, and can be instan- tiated with essentially no loss in model quality.
To address these issues, a substantial body of research has focused on watermarking LMs, i.e. embedding a signal into generated text that the provider can use to determine whether or not a given example was machine-generaaed. In order for watermarking to be practical, it must possess few key properties: (a) watermarks should be easily detectable with formal statistical guarantees; (b) watermarking should not degrade LM performance either in quality or latency; and (c) watermarks should remain detectable after common token- and sequence-leve corruptions are applied. Among these desiderata, formal statistical guarantees on the validity of the watermark are particularly important in situations where authorship claims are sensitive, with recent exam- ple being lawsuit against a Massachusetts school by a student's parents after the school wrongly accused a student of cheating with ChatGPT (Tenbarge. 2024); while such claims do not always rise to the level of litigation, examples of students falsely accused of cheating due to unreliable detection abound (Jimenez, 2023; Klee, 2023; Giray, 2024; Mathewson, 2023; Verma, 2023). As such, watermarking schemes relying on heuristics or trained detectors, such as Dathathri et al. (2024), cannot be reliably deployed.
1. Introduction
Recent advances in Language Models (LMs) have signifi- cantly transformed the field of Natural Language Process- ing, offering unprecedented capabilities in generating high-
Prior works have proposed a plethora of watermarking schemes in recent years, discussed in detail in Appendix While some, such as that of Dathathri al. (2024), allow for efficient and practical watermarking, in order to maintain high quality text, they require storage scaling linearly with the number of generated tokens, which can be impractical in large production systems. Others achieve rigorous guar- antees for watermarking by embedding statistical patterns into the autoregressive next-token sampling process of lan- guage models and further emphasize indistinguishability
'iiroooott Research, New York, USA DDepatment of Computer Science, Columbia University, New York, USA 'Department of Computer Science, MIT, Cambridge, MA, USA "Boston University, MA, USA. Correspondence to: Adam Block <adam.block col.ebba..oummbbcuu.c..... Ayush Sekhari <sckhari @ mit.edu>.
Proceedings of the nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

GaussMark: Structural Watermarking of Language Models
0.200
empirically when assessed on the quality of the generated text. Perhaps most similar to the current paper is the concur- rent work of Christ et al. (2024a), which proposes adding a Gaussian vector to the bias in the final layer of an LM in an effort to ensure the watermark is difficult to remove even after open-soureing the model. While the focus of that work is not primarily on formal statistical guarantees the resulting watermark, they demonstrate that under natural assumptions on the access an adversary has, is challenging to remove the embedded watermark without degrading the quality of the model; such results likely also apply to our proposed approach.
Mistrl Llema
0.175
Modian p-value
0.150
0.125
50.100
0.075
0.050
0.000
460
600
1000
Number of Tokens
(a) The median p-value of GaussMark av- eraged on IK watermarked generations.
Input Phoorge 50-31 faas will cojtion with tolly's detaal about speciiae
pier. Dvcas Wlaee Thx Evrm
In this work, we propose GaussMark, a novel approach that takes advantage of the structure inherent to text by modi- fying the model weights through a Gaussian perturbation at generation time and tests for statistical independence detection time. Our approach is motivated by empirical observations that language models are robust to small per- turbations of their weights, as evidenced by phenomena such as linear interpolation through model merging and model fine-tuning by thresholding or modifying weights along low- rank components, which does not degrade output quality (Sharma al., 2024; Sun et al., 2023; Hu et al., 2021). Our method is simple to implement and efficient, providing both significant detection ability and essentially no loss in model performance. Our key contributions are:
Boen (mveotrrmarae)) Llbrad 1- 4D Model by Clock hum just bose inwreed Dark XiS Ancres coricos goes ore
inloar is Spilit 2012 Alss
ottiial gues guospday viow and someralate selver Whed pepclic (Ill qulpit dte has buker wase wovedotte of the sporning Atdood DX Actading to the fintor spdated laps tae
borm 16 lves
HTCss
Gate calla-- maaial witk BBC Stedan lestg lindla lead on the BBC parsar Dscisr Mils Doeis Miae The Eternd samerlly realiplion onler edoplenin gaze heal in the and Leed the Dikas, tho beat Oppere Gasen,
Watemmereed Chanat 1-B Modsl:
sereded
bern
Eiseall, eatra chorndoed bengg that plpeed planad wae la aneed koy dodia from Dector Whos Antong the Eirerad counpie laaven Caavesiig Ston, show appoetioas plans fo sabvore kon apecatyti detmactko....
(b) Example watermarked and unwatermarked text.
Figure 1. Demonstration of the efficacy of GaussMark on C4 prompts (a) and of snippet watermarked text (b). The full text completions are given in Appendix J.1
we introduce GaussMark, a novel wa- termarking scheme that is practical, efficient, and has no effect on generation latency. Therein, we motivate GaussMark using classical statistical theory, and pro- vide rigorous guarantees on the statistical validity of GaussMark under essentially no assumptions. We then theoretically analyze the power of GaussMark to be de- tected under modeling assumptions approximating mod- ern language models.
In Section 3,
or distortioonffreensss (Kuditipudi et al., 2023; Christ et al., 2024b; Golowich and Moitra, 2024), requiring the water- marked text to closely resemble unwatermarked text in Total Variation (TV) distance. However, this approach overlooks the inherent structure of language, treating text as merely a sequence of tokens generated by an unstructured autoregres- sive process. While this focus on distortion-freeees helps safeguard text quality, it often comes at the cost of other crucial properties, such as efficiency; for example Kudi- tipudi et al. (2023), exhibits extremely slow generation and detection. Fortunately, such stringent distortion- iistortion-freeness is not necessary in practice, as the primary goal is to generate text that appears indistinguishable from unwatermarked text to humans. Recent empirical evidence suggests that humans have limited ability to differentiate between high-quality generated text and subtle variations thereof (Dugan et al., 2023; Clark et al., 2021; Ippolito et al., 2019; Elangovan et al., 2024; Lee et al., 2022), suggesting that instead of enforcing approximation in TV, weaker metrics like Maxi- mum Mean Discrepancy (MMD) (Gretton et al., 2012), eval- uated using the implicit criteria humans employ to assess text quality, may be sufficient. Furthermore, natural lan- guage exhibits intricate implicit structures that modern lan- guage models learn and encode within their weights. While some recent work has introduced distortionary watermarks (Kirchenbauer et al., 2023a;b), they tend to underperform
In Section 4, we describe key empirical results providing a comprehensive evaluation of GaussMark on a variety of modern LMs, demonstrating its detectability and lack of effect on model quality.
We supplement our empirical results in the main body with am extensive exploration of (i) ablations investigat- ing the effects that different parameter choices have on both detectability and model quality (Appendix D and Ap- pendix E); (ii) demonstrations of the relative robustness of GaussMark to token- and sequence-level corruptions (Appendix F); (ii) an investigation of a low-rank vari- ant of GaussMark that further reduces the watermark's 'ss impact on model quality (Appendix G); and (iv) a compar- ison of GaussMark to the scheme of Kirchenbauer et al. (2023abb), demonstrating that while GaussMark can be less detectable and robust to corruptions. it has a much smaller impact on the quality of the generated text and
2

---

GaussMark: Structural Watermarking of Language Models
allows for significantly faster generation (Appendix H).
T2 1, the response text y (V1y..., ur) V2 is generated by autoregressively sampling from the language model for
2. Problem Setup and Prerequisites
T tokens using the process it pe(- x o U1:-1) 1) for t [T'. We often use the notation y= U1r (e (-1 x) to represent the above sampling process.
2.1. Hypothesis Testing
We begin by recalling the formalism of hypothesis testing from classical statistics (see Casella and Berger (2001); Lehmann et al. (1986) for a thorough introduction).
2.3. Watermarking Text Generated by LM
We next formalize watermarking as a hypothesis testing problem, a framework that has also been used in prior rig- orous watermarking works (Huang et al., 2023; Kuditipudi et al., 2023; Kirchenbauer et al., 2023a). Formally, a water- marking scheme consists of Generate and Detect proce- dures. Given prompt space X = V", a key space E IR and a sample space y/ & V (consisting of strings from the token space), watermarking takes place in two steps:
Definition 2.1. Given a domain 2, hypotheses Ho and HA are nonempty collections of probability measures on Z, with Ho called the null hypothesis and HA called the alternative hypothesis. If Ho (or HA) is singleton, we call it simple; otherwise, we call it composite. A test is any measurable function p: Z + 13.
We assume there exists a ground-truth distribution p e Ho u HA and, given a sample Z ~ p, we wish to use the test p to inform us as to whether we can confidently say that p E HA (i.e. p())= 1) or if we, by default, do not have sufficient evidence to discount the hypothesis that p e Ho (i.e. p(2) = 0). As such, there are two relevant notions of error: the probability that we falsely reject the null hypothe- sis (Type-I error) and the chance that we falsely accept the null hypothesis (Type-II error). These errors are controlled by the level and the power of test p.
1. Generate is parameterized by a language model po : X + A()) and a distribution v & A(=). When given a prompt x X, Generate samples a key & ~ u and returns the watermarked text y ~ Po(e) (- z)). where ((E) denotes the model watermarked using the key 5.
2. Detect takes a watermarking key g' 6 E model po. and some candidate text y' E y then tests the following:
Ho Given x. the key and the sample are independent, i.e.,
(f', v/) ~ @ y with q e A()).
Definition 2.2. Let a, B E (0, 1). Given hypotheses Ho and HA. and test/ p: Z + {0, we say that p has level if suppeH, Prz-p (p(Z)= 1) S a, i.e., for any dis- tribution in Ho. the probability we falsely classify sam- ple from that distribution as coming from a distribution in HA is at most a. We say that has power 1 - 8 if A Prz-p (p(Z)= 0) 0) S 3, ie.. the probability that we accept the null hypothesis despite the fact that the true distribution is in A bounded above by 3. Finally, func- tion p: Z- [0, 1] is called p-value if for all [o, 1] it holds that su Prz-q (v(2) ()=+) S a) S a.
HA: : The sample y is produced by Generate using the key 5", i.e., y/ - -Pe(e)(: x=).
Our goal in designing a watermarking scheme is to choose v such that for any æ, the modified language model po(e) gen- erates text that sufficiently distinct from that of the original language model pe when the key is known, but the same time has good quality and is relatively indistinguishable when & is unknown. We emphasize that the null hypothesis considered above does not assume that y' ~ ( | x), as this would allow for human-generater text to be classified as machine- getbrrtegeeerteed as long as the human's 's distribution is sufficiently different from the model's. Instead, Ho is a composite hypothesis that places no structural assumption the distribution Q of responses and thus encompasses text generated by humans or even other LMs. We note that this formulation is similar to that of Huang et al. (2023), except that we drop the additional requirement in that work that the marginal of y in HA is c-close in TV to the original LM's distribution; as we stated above, we believe TV to be an unnecessarily strong metric for bounding degradation in model quality.
We aim to design tests p that maintain a low probability of rejecting the null hypothesis when it is true (i.c. a x 0) while achieving a high probability of rejecting the null hypothesis under the alternative hypothesis (i.e. B 0). The p-value is a crucial tool in hypothesis testing, as it provides a measure of evidence against the null hypothesis. Specifically, it represents the probability of obtaining a result at least as extreme as the one observed, assuming the null hypothesis is true. Thus, smaller p-values imply that Ho is less likely.
2.2. Language Models
A Language Model (L.M), parameterized by weights 0 c θ and token space V. is represented by function pa: V* + A()) that maps a sequence of past tokens to a distribution over the next-token, where V" is the set of all strings of tokens in V. Given a prompt x V** and generation length
3. Watermarking Scheme: GaussMark
Our scheme, GaussMark, applies to an arbitrary parame- terized model, where pa = + A(V") is a distribution
with parameters E θ c Rdd. In GaussMark. Generate
3

---

GaussMark: Structural Watermarking of Language Models
Algorithm 1 G
illustrative example in Appendix I.1.
1: Input Language Model pa: V" + A()) with parame-
Practical Implementation. Modern language models are parameterized by billions of parameters (Kaplan et al., 2020; Touvron et al., 2023) and, while GaussMark could be im- plemented across the entire model, we find that effective watermarking can be achieved by modifying a single MLP weight (a matrix) within a single layer. This approach of- fers two key advantages: First, perturbing parameters in a single feedforward layer minimizes potential degradation in model quality. Specifically, GaussMark relies on the statistical distinguishability of the distributions pe-ę(- x) and p x)) which we observe can be achieved without compromising model performance. Recent empirical stud- ies demonstrate that much of the signal in the feedforward layers of language models resides in low-dimensional man- ifold. Consequently, any added noise & to single layer is likely almost orthogonal to the underlying signal, preserving model quality. Second, GaussMark. Detect incurs minimal memory and computational overhead as it requires only a single forward pass through the model and backward pass through the watermarked parameter A. When 0 is a single MLP layer, the memory cost of taking a gradient is negli- gible compared to the memory demands of a forward pass. In any case, simplicity of our approach allows seamless integration into generation pipelines such as vLLM (Kwon et al., 2023) and HuggingFace (Wolf et al., 2020b).
ters e O prompt x, variance o² > 0.
2: Sample watermark key {~ (0,o²1);
3: Watermark model by setting ((E) = 0 E.
4: Generate using the perturbed model: y ~ Po(e) z))
(Algorithm 1), we generate the watermarking key & by sampling from a centered multivariate Gaussian distribu- tion with covariance I for some small a > O, i.e. ç v with V= = (O,
We then produce the watermarked model ((E) by additively perturbing 0 with the key ç. i.e. (())= = c. On the given imput prompt z, we then generate the watermarked response by sampling y ~ Pe(e) (r))
Algorithm 2 GaussMark.
1: Input Language Model pe: =V + A()) with parame- ters O O, prompt z, variance o² O, watermark key &, candidate text y E V/ level 10,
2: Evaluate the test statistic
Vo x))
(v.E a Pog [x]
(L)
3: Return 'Watermarked' if (3. x) 2 x 1 (1-a):
else fail to reject null.
3.1. Motivation
In GaussMark. Detect (Algorithm 2), we test the compos- ite hypothesis Ho. that 5 NN00, II) and y ~ q E A(Y) are independent of each other, against the simple alterna- tive hypothesis that y ~ po-c(- æ)) using the test statistic Ev. 1)) given in (1). Letting & denote the cumulative distribution function (CDF) of standard Gaussian random variable, we reject the null hypothesis (determine the text is watermarked) if (v. z) 2 4(1 aa), where a denotes the acceptable false positive rate (Type-I error). Although GaussMark. Detect is formulated as a statistical test, in our experiments we report the p-value, (vy z)).
Recall from Definition 2.2 that there are two sources of error in hypothesis testing; false positives (controlled by the level of the test) and false negatives (controlled by the test's power). Because these two desiderata are at odds, statisti- cians either wish to find tests with maximal power subject to a constraint on the level (Neyman and Pearson, 1933) wish to control the risk of a test, defined for weights o, b e R2 as ac bB. In either case, as long as the null hypothesis is convex, under general measure theoretic con- ditions (cf Lehmann et al. (1986, Theorem 3.8.1) for the Neyman- Pearson approach and Le Cam (2012); Ghosal and van der Vaart (2017) for the case of minimax risk), the op- timal test is given by likelihood ratio test with respect to the 'worst-case' distribution in Ho, which can be shown in special cases to be that in Ho which is closest in TV to HA Thus finding the optimal test reduces to finding the 'worst' p E Ho and rejecting Ho if log PHa/P is large. Unfortunately, in many settings, it is not clear how to charac- terize this p in a way that is amenable to computing p-values or the thresholds for test statistics. On the other hand, if we relax projection in TV to projection in KL divergence, standard calculation shows that the the closest distribu- tion in Ho to HA is given by marginalizing over ç, i.c. y & Le-_epPoter x)] (cf. Proposition 1.2 in Appendix I.1), Heuristically, then, a reasonable candidate for the optimal
It is critical that our test is valid for the composite null hypothesis Ho. allowing any q A())) without imposing assumptions on the distribution of y under the null. A test that is valid only for simple null. such as ~ Pe(-) | æ). against HA may fail to have a small level when applied to arbitrary comman-generated text that does not originate from
the model pe. which would undermine the key benefit of a watermarking scheme with formal statistical guarantees. As explained in the sequel, the choice of Gaussian & is motivated by the fact that Gaussians (a) are rotationally invariant and (b) have independent directions and norms. In principle, any distribution with these properties could replace the Gaussian, and with minor modifications, the test would still maintain statistical validity. We provide an
4

---

GaussMark: Structural Watermarking of Language Models
test between Ho and A would be reject the null when the log- likelikkehood ratio of the data under the null and the alternative is larger than some threshold To satisfying
In practice, we watermark by adding the noise & to feed- forward layer in single transformer block (see Section 4 for exact implementation details). The above linear softmax model is motivated by the empirical observation that LM's are well-hehaved in a small neighborhood around a trained model's parameters, and can thus be locally approximated via a first-order Taylor's expansion (cf. Appendix 1.3 for further discussion). Recent empirical findings on model merging via linear interpolation of weights provide further support to the assumption that the model behaves linearly in small neighborhood around the trained parameters (Worts- man et al., 2022; Chronopoulou et al., 2023; Yang et al., 2024; Goddard et al., 2024; Ilharco et al., 2022; Yu et al., 2024). The preceding reasoning suggests that at least next- token prediction can be approximated by a linear softmax model, but a key benefit of the same is that the property of being such a model is preserved under autoregressive generation (cf. Appendix 1.3.1). This intuition suggests that our theoretical results hold only for sufficiently small o. Indeed, as shown in our experiments, when o becomes too large, GaussMark starts to lose its power (cf. Appendix D). We next bound the power of our test:
Po-s (V z)) [p-n- (y x)]
sup pp log pe
Ta a.
While (2) would yield a valid (although possibly supoptimal) test, it is not obvious how to easily compute the threshold Tox nor is it clear that computing the second term in the test statisties is feasible due to the scales of the probabilities involved. In order to circumvent these problems, we approx- imate the ligeliiel test to first order, specialize to the case that V (0, I)),, and further suppose that << so as to ignore terms scaling with x² (see Appendix 1.1 for details); we then have
(E, Vo pog x)). (3)
Thus, under the above linearization approximation, the statistic (E: Vo log x)) yields test approximately as powerful as that in (2) that is easily computed, solving the second problem above. The key insight in solving the first problem and determining To is, due to the rotation invari- ance of the Gaussian and the fact that the direction and norm of Gaussian vectors are independent, the distribution of y Iz), given in (1), is always a standard normal un- der Ho because y is independent of E; thus with appropriate normalization, Ta can be read off from the Gaussian cumu- lative distribution function. This insight is formalized in the following proposition wherein we show that GaussMark, delivers statistically valid p-values, and is even an exact test, ensuring provable control of the false positive rate under virtually no assumptions.
0- Let Py be given by a linear softmax model w.r.t. some under- lying features ip. Then, for any x e X, the hypothesis test I{ (5.7 (..V.ogro 2 Taj from Algorithm 2, is level a and Il [
Proposition 3.3. Let a E (0, 1) and Ta = =
has power 1 - 3, where
3 3=B E y-pa (=N(00.0'1)
[>(v 147 sToll, (4)
with (V, == els. (olpooollo///e-ppoo [ole. [lx.pooool)
We remark that our computations for the bounds on the level and the power of our test are valid for any fixed x X, but are marginalized over the key ç, as is common in other sta- tistically valid watermarks (Christ et al., 2024b; Kuditipudi et al., 2023; Golowich and Moitra, 2024). The multiplica- tive factor of (v. x) in (4) is a reweighing that tilts the underlying distribution y ~ po 2) to prefer those y for which (E, V pe xx)) is large. On the other hand, the indicator term is non-zero only when (/y.E x)), which depends on (S. V log x)), is smaller than Tai thus, in general, we should expect the power of the test to in- crease (i.e. ,3 to be smaller) as we place more mass on those y for which (E, V Po x)) is large. While intuitive, this logic suffers from the fact that if V log |>>] can vary widely depending on y, those responses maximizing (E, v log po .z)) may not be the same as those maximiz- ing (v.EE | 2:) due to the invariance of the latter, but not the former, to the norm; this is precisely the price we pay in moving from (3) to (1) by normalizing.
Proposition 3.1. Let a E 10. and Ta == == a)
where & is the CDF of the standard normal distribution. (&.V log pu((())))) Then, for any x E X, the test If { logro(y=)) Jaj in Algorithm 2 has level a. Furthermore, 1 1- &V x)) a valid p-value for the test.
3.2. Bounding the Power of GaussMark
While statistical validity holds unconditionally, we must make some assumptions on the model in order to guarantee any nontrivial power. Indeed, in the trivial case where pe is constant in 0 and v lo =)) 0 identically, clearly cannot hope to achieve any watermarking detection with GaussMark as all models are identical. Motivated by our application to LMS, we consider the following setting.
Definition 3.2 (Linear softmax model). Let X and Y be discrete spaces, 0 E IRd be the underlying model's param- eters, and 4p )) x X + Rd a known feature map. We say po | =) is a linear softmax model if, for all y E V, po 5:) = sto.nt //,, do.l)/w))
To better understand the bound on the power of the test in Proposition 3.3, consider the simplified setting where
5

---

GaussMark: Structural Watermarking of Language Models
00, and suppose that there exists r 0 such that r s | Po (y =)]l R for all y e y and æ X. In this case, for any fixed ç. the exponential tilting places all of the mass on y" (5) := argmax, (E. v log (1/ æ)), and few simple calculations imply that
0.8
0.05
Mistral
0.2
B= Prz-N((o.)) (Z, yey
(Z, V logpo s Saa R//r)
Phi
0.0
0
200
400
600
800
1000
Number of Tokens
(a) Fraction of detected watermarked re- sponses at p 0.05 (averaged over 3 seeds)
Thus, the power of the test depends on the distribution of supy (Z, V log log Ly] æ:)) for Z (O, Tz), whose expec- tation is the Gaussian width of the set {V log po (v x)).a well-known measure of the complexity of sets in learning theory (Vershynin, 2018). Were the feature set (+(() yey sufficiently rich, the vectors {V log Po (1/ x)) would cover the unit sphere, making this supremum large with high probability (See Appendix I.3 for a discussion on the role of entropy in ensuring such diversity). In this case, we expect sup, (Z, v logro(y x)) |2| Under these simplifica- tions, GaussMark achieves power at least 1 - 3 at level a, provided d 2 log ( (/minto.00) R/r, which captures the intuition that bigger models are easier to watermark since larger dimension makes easier to hide the watermarking signal without hurting the model performance. We observe that across number of recent LMs, the actual conditioning is less than 50 (cf. Figure 6), suggesting that the above is reasonable approximation of what is observed in practice. This intuition also aligns with our empirical observations that larger noise generally makes watermarking easier (cf. Appendix D) and longer sequences are easier to watermark: || log Po 2)]l grows with sequence length (Figure 2) and more choices of y increase the likelihood that {V log ps (y })). Moreover, this framework is consistent with earlier work that shows that higher-entropy sequences are fundamentally easier to watermark (Kuditipudi et al., 2023; Fairoze et al., 2023; Christ et al., 2024b; Golowich and Moitra, 2024; Huang et al., 2023), since | log ( x)] tends increase with entropy. We formalize this intuition in Corollary 1.5 (in Appendix 1.3.1) under mild assumptions.
7.0
Squared Norm
6.0
5.5
5.0
4.5
3.5
Mistral
Phi
2.5
0
200
400
600
800
1000
Number of Tokenss
(b) |V log pa (y)l vs. number of tokens
Figure 2. Effect of length generated token sequence on p-values and gradient norm for GaussMark.
4. Experiments
In this section, we empirically validate our watermarking scheme. In our experiments, we use the HuggingFace repository (Wolf al., 2020a) to load our models, vLLM (Kwon et al., 2023) for generation, and PyTorch (Paszke et al., 2019) for watermark detection. For examining the quality of our watermarked models, we make use of EleutherAI's
(Gao et al., 2024) as well as the AlpacaEval framework of Li et al. (2023b), All of our experiments are run on 40GB NVIDIA A100 GPUs, with each model chosen sufficiently small that single GPU suffices for both generation and detection.
In addition to linear softmax models, we can also control the power of Mark in significantly greater generality. In Appendix 1.3.2, we provide bound on the power of the test when the distribution po is strongly log-concave. Our pri- mary detection method in Algorithm 2 empirically exhibits some robustness against modifications. including insertions, deletions, substitutions, and roundtrip translations (ef. Fig- ures 13 and 14). In Appendix F, we provide theoretical analysis (cf. Proposition 1.9 of the robustness of variant of GaussMark (Algorithm 4) against random token-level corruptions under mild independence assumptions; this ap- proach can also arbitrarily enhance the statistical power of GaussMark as the length of generated text increases.
Key Experimental Details. The GaussMark procedure de- scribed in Algorithms I and 2 can be used essentially out of the box, requiring careful selection of two key hyperparam- eters: the variance of the Gaussian noise, a, and the specific parameter 0. Statistical validity (Proposition 3. holds in- dependent 0 and σ. whereas Proposition 3.3 (our power bound) is mostly agnostic to the precise 0 and suggests that should be large subject to the linear approximation re- maining sound. Selecting these hyperparameters requires careful consideration to ensure pa-ş is sufficiently distinct from Pa for GaussMark to detect while avoiding adverse im- pact on generated text quality. As such, the choice of these parameters is a careful empirical balancing act. For each of
6

---

GaussMark: Structural Watermarking of Language Models
the language models under consideration, we choose 0 to be a single MI.P layer (cf. Appendix C). The choice of both 0 (which can vary over layer and MLP parameter within the architecture) and a is made by maximizing detectability subject to the evaluation metrics of the model remaining on par with those of the unwatermarked counterpart.
0.16
Mistral
0.14
Liama
0.12
2
Time
0.08
0.06
0.04
0.02
4.1. Can GaussMark be Detected?
0.00
As has become standard in recent empirical evaluations of watermarking (Kirchenbauer et al., 2023a; Kuditipudi et al., 2023; Lau et al., 2024; Pan et al., 2024), we use the realnewslike split of the C4 dataset (Raffel al., 2020) as prompts for generation. We the same 1K prompts for all models and all watermarking keys in order to make the comparison fair. We consider three recent LMs: Llama3.1-8B (Dubey et al., 2024). Mistral-7B (Jiang et al., 2023), and Phi3.5-Mini (Abdin et al., 2024). The last, Phi3.5-Mini was instruction fine-tuned and thus performs significantly better on number of reasoning, math, and coding tasks (Abdin al., 2024) well generating sub- stantially lower entropy sequences, making watermarking more challenging (Kirchenbauer et al., 2023a; Aaronson and Kirchner, 2022: Christ et al., 2024b; Kuditipudi et al., 2023). Thus, we see Phi3.5-Mini as a particularly challeng- ing model to watermark, which shows up empirically in Figures 1 and 2. In Figure 2(b), we see that as the number of generated tokens increases, V log po (y | increases as well; Moreover, comparing plots (a) and (b) shows the strong relationship between gradient norm and p-vuuues pre- dicted by our theory.
Number of Tokees
(a) Generation time
0.8
Mistral
0.7
Ilama
0.6-
Phi
0.5
Timee
0.3
0.2
0.1
0.0
200
600
600
800
1000
Number of Tokens
(b) Detection time
Figure 3. Lateney of GaussMark in seconds for generation (a) and detection (b) as number of generated tokens increases.
and multi-shot prompting provided by Gao et al. (2024) in order to standardize our results. Finally, AlpacaEval-2.00 is a significantly more challenging task, where the candidate and benchmark language models generate responses to ap- proximately 800 questions and a larger 'evaluator' language model (used as proxy for human preferences) decides which response is better. Instead of comparing win rates against responses generated by humans or much stronger model, we directly evaluate the win rate of watermarked models relative to un un-watermarked models to enhance the signal. For cost efficiency, we use GPT-4o, the current flag- ship model of OpenAT, as the evaluator, as opposed the older GPT-4-Turbo model used in Li et al. (2023b).
A notable feature of GaussMark is its remarkable speed in both generation and detection. As shown in Figure 3, gen- erating 1K tokens takes only milliseconds, while detection requires less than a second even for the same token count. Comparing these times to those of Kuditipudi et al. (2023), we see that GaussMark is significantly faster and even has lower latency than reported in Dathathri et al. (2024), which does not have statistical guarantees. We defer further inves- tigation and ablation experiments to Appendix D.
4.2. Does GaussMark Degrade Model Quality?
We report our results in Table 1. For SuperGLUE, we aver- age the scores over the 8 tasks (cf. Appendix E for scores on individual tasks, and further discussion and experiments) and, along with the GSM-8K task, we report mean accuracy and standard error. For AlpacaEval-2.00, we report the win rate of the watermarked model against the un- un-watermarked model; in order to handle stochasticity, also consider the evaluator's 's preferences when comparing the unwatermarked model to itself with different seeds used for generation and report this performance as an interval. We observe that each of the models discussed in Section 1 can be watermarked with GaussMark with essentially no loss in performance.
To evaluate the effect of GaussMark on text quality, we employ three benchmarks: SuperGLUE (Wang et al., 2019), GSM-8K (Cobbe et al., 2021), and AlpacaEval-2.0 (Dubois et al., 2024; Li al., 2023b); in Appendix E, we report the effect that watermarking has on model perplexity of real text. The first benchmark, SuperGLUE, is col- lection of eight challenging language understanding and reasoning tasks. The second, GSM-8K is a collection of approximately 8K grade school math questions. For both tasks, we use the LM Evaluation Harness (Gao et al., 2024) to evaluate performance using the Chain of Thought (CoT)
7

---

GaussMark: Structural Watermarking of Language Models
Table Performance of GaussMark on various models.
Model
SuperGLUE (Avg)
GSM-8K (Ace)
AlpacaEval-2.0 (win rate)
Unwatermarked
GaussMark
Unwatermarked
GaussMark
Unwatermarked
GaussMark
1lama3.1-8B
0.7012 0.0336
0.7094 = 0.0327
0.6300 0.0133
0.6111 0.0134
(0.46, 0.54)
0.45
Mistral-7B
0.6836 # 0.0335
0. 0.7033 = 0.0332
0,4291 # 0.0136
0.4321 + 0.0136
(0.49, 0.51)
0.50
Phi3.5-Mini
0.6451 0.0254
0.6489 = 0.0258
0.8423 0.0100
0.8552 = 0.0097
(0.46, 0.54)
0.49
4.3. Additional Experiments
5. Discussion
We defer full discussion of our other empirical results to the appendix for the sake of space and summarize them here.
In this work, we introduced a new watermarking scheme, GaussMark, with theoretical guarantees on statistical valid- ity and power, and empirically demonstrated its efficacy.
Robustness. One important characteristic of any deployable watermark is corruption-robusteess in Appendix F we inves- tigate the extent to which GaussMark is robust to token-level additions, deletions, and substitutions as well as a roundtrip translation attack through French. In all cases, we find that GaussMark is somewhat robust these attacks and is espe- cially robust to corruptions that occur contiguously. This latter property is especially important as it demonstrates that, despite the seeming need of GaussMark to know the prompt, which is unrealistic in practical scenarios, this requirement can be dropped with minimal loss of performance.
Advantages of GaussMark. The primary advantage of GaussMark is that it is the first simple, efficient, and statisti- cally valid watermarking scheme that can be immediately in- tegrated into existing inference pipelines with essentially no modification and absolutely no impact on generation latency. In addition, detection speed is extremely fast relative al- ternative schemes and has memory requirements essentially on par with those of inference. Furthermore, GaussMark is somewhat robust to corruption and, in practice, does not need to know the prompt or any other information about the text to detect the watermark (cf. Figure 14). In contradistine- tion to many alternative watermarking schemes, which focus on the next-token sampling process and whose robustness is often limited to edit-distance corruptions, GaussMark changes the distribution of the text itself and thus can be viewed as form of 'structural' watermarking, which has the potential to be more robust to a wider variety of corrup- tions such as roundtrip translations. Finally, unlike prior works, GaussMark is not restricted to the next-token pre- diction paradigm in autoregressive language models; by design, it can also be readily implemented in emerging hy- brid paradigms such as Language Diffusion Models (Nie et al., 2025), direction we leave for future exploration.
Renueteed Motivated by recent empirical work sug- gesting that lower principal components of the weight matri- ces can be treated as 'noise' and their removal can improve model performance on some tasks (Hu et al., 2021; Sharma et al., 2024; Dettmers et al., 2024; Guo et al., 2023; Han et al., 2024; Wang et al., 2024), in Appendix G we propose a modification of GaussMark, where noise is only added to the bottom & principal components of the watermarked weight. Extensive exploration of the effects of this inter- vention demonstrates that rank-reduction allows GaussMark to tolerate greater a (and associated detectability) without compromising model quality, although this can occur at the cost of decreased robustness.
Limitations of GaussMark. While there are a number of benefits of GaussMark relative to prior approaches, there are four key limitations.
Comparison with Kirchenbauer et al. (2023a). In Ap- pendix H. we compare GaussMark with the only other prac- tical watermarking scheme with statistical guarantees detectability currently implemented of which we are aware: that of Kirchenbauer et al. (2023a;b). We find that setting the parameters of this other scheme in such a way as to mathh the generation quality of GaussMark leads to dimin- ished detectability and robustness relative to our approach. Furthermore, we find that their generation latency is several orders of magnitude greater than GaussMark (Figure 27).
(1) Unlike many alternatives, GaussMark has no formal guarantees of distortion freeness; while we have empirically demonstrated that GaussMark does not hurt model quality on range of understanding, reasoning, math, and conversational benchmarks, further investigation on the effects on text quality is required be- fore GaussMark can be safely deployed. (2) In general, GaussMark requires more tokens to reliably detect water- mark than alternative approaches (Kuditipudi et al., 2023; Kirchenbauer et al., 2023b; Dathathri et al., 2024); that said, the speed of GaussMark allows our approach to remain competitive, as we can detect even 1K tokens much more quickly than some alternative approaches require to detect 200 tokens (Kirchenbauer et al., 2023b). (3) Unlike some al-
Miscellancous. We conduct many additional ablations to better understand the effect of different choices of wa- termarking hyperparameters on GaussMark both w.r.t. de- tectability (Appendix D) and model quality (Appendix E).
8

---

GaussMark: Structural Watermarking of Language Models
ternative schemes, GaussMark assumes white-box access to model weights in order for detection to be possible; view this as natural, motivated by setting where the LM provider offers watermarking detection as an additional service on top of the LM itself, but this is a stronger access model than is considered in some other works (Golowich and Moitra, 2024; Christ et al., 2024b; Aaronson and Kirchner, 2022: Kirchenbauer al., 2023b; Kuditipudi et al., 2023). (4) GaussMark is less robust to token-level corruptions than Kuditipudi et al. (2023), although is potentially more ro- bust than instantiations of the scheme of Kirchenbauer et al. (2023a) that preserve text quality. Finally, in addition to the above limitations, we did not explore the extent to which aggressive quantization can lead to a reduction the ability detect GaussMark, which may pose challenge in practi- cal deployment. We leave the interesting question of how to make approach quantization-awaa -ware future work.
ppt.
Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadal- lah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, al. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404. 14219, 2024.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ah- mad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023.
Janice Ahn, Rishu Verma, Renze Lou, Di Liu, Rui Zhang, and Wenpeng Yin. Large language models for mathemat- ical reasoning: Progresses and challenges. arXiv preprint arXiv:2402.00/57, 2024.
Future Directions. GaussMark is first step toward gener- ating structural watermarks in LMs, but potential improve- ments abound. In particular, while we propose adding noise to low-rank components of the model weights as some way to mitigate the trade-off between model quality and wa- termark detectability, we did not explore alternative meth- ods, such as training the model slightly after adding noise, adding noise only to a sub-network identified by mecha- nistic interpretability (Templeton et al., 2024; Bereska and Gavves, 2024), or noising multiple weights at once. As well as potential modifications of the intervention itself, addi- tional probing on the effect GaussMark has on text quality is likely necessary before widespread deployment. In particu- lar, we did not investigate the effect that our approach has safety alignment benchmarks, important component of production-reayy LMs.
Leonard Bereska and Efstratios Gavves. Mechanistic in- terpretability for ai safety-a review. arXiv preprint arXiv:2404.14083 2024.
Massich Kordi Boroujeny, Ya Jiang, Kai Zeng, and Brian Mark. Multi-bit distortion-fre free watermarking for large language models. arXiv preprint urXiv:2402. 16578, 2024.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership infer- ence attacks from first principles. In 2022 IEEE Sym- posium on Security and Privacy (SP), pages 1897-1914. IEEE, 2022.
George Casella and Roger Berger. Statistical infer- ence. Duxbury Resource Center, June 2001. ISBN 0534243126.
Acknowledgements
AS thanks Martin Pawelczyk for useful discussions. AB thanks Jordan Ash and Cyril Zhang for helpful discussions. AS and SR acknowledge support from the Simons Foun- dation and NSF through award DMS-2031883, well as from ARO through award W911NF-21-1-0328.
Hongyan Chang, Hamed Hassani, and Reza Shokri. Water- mark smoothing attacks against language models. arXiv preprint arXiv:2407.14206. 2024.
Miranda Christ, Sam Gunn, Tal Malkin, and Mariana Raykova. Provably robust watermarks for open-source language models. arXiv preprint arXiv:2410.18861. 2024a.
Impact Statement
This paper presents work whose goal is advance the field of Machine Learning. There are many potential societal consequences of our work, none of which we feel must be specifically highlighted here.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable wa- termarks for language models. In The Thirty Seventh An- nual Conference on Learning Theory, pages 1125-1139. PMLR, 2024h.
References
Alexandra Chronopoulou, Matthew E Peters, Alexander Fraser, and Jesse Dodge. Adaptersoup: Weight averaging to improve generalization of pretrained language models. arXiv preprint arXiv:2302.0007, 2023.
Scott Aaronson and Hendrik Kirchner. Watermark-
ing gpt outputs. 2022. URL https:/ //www.
9

---

GaussMark: Structural Watermarking of Language Models
Elizabeth Clark, Tal August, Sofia Serrano, Nikita Haduong, Suchin Gururangan, and Noah A Smith. All that's 'hu- man' is not gold: Evaluating human evaluation of gener- ated text. arXiv preprint arXiv:2107.00661, 2021.
Yu Fu, Deyi Xiong, and Yue Dong. Watermarking condi- tional text generation for ai detection: Unveiling chal- lenges and semantic-aware watermark remedy. In Pro- ceedings of the AAAI Conference on Artificial Intelli- gence, volume 38, pages 18003-18011, 2024.
Karl Cobbe. Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plap- pert, Jerry Tworek, Jacob Hilton, Reicchro Nakano, Christopher Hesse, and John Schulman. Training ver- ifiers to solve math word problems. arXiv preprint arXiv:21 10.16688, 2021.
Margherita Gambini, Tiziano Fagni, Fabrizio Falchi, and Maurizio Tesconi. On pushing deepfake tweet detection capabilities to the limits. In Proceedings of the 14th ACM Web Science Conference 2022, pages 154-163, 2022.
Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac'h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Ja- son Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. A framework for few-shot language model evaluation, 07 2024. URL https: / zenodo. www.oooooooogoeooooooooooooooooo http:/eerrrrr/c/ee//eeeee
Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, et al. Scalable watermarking for identifying large lan- guage model outputs. Nature, 634(8035):8) (110355)888-255) 88-823, 2024.
Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. Qlora: Efficient finetuning of quantized Ilms. Advances in Neural Information Processing Systems, 36, 2024.
Sebastian Gehrmann, Hendrik Strobelt, and Alexander M Rush. Gltr: Statistical detection and visualization of generated text. arXiv preprint arXiv: 04044444443 2019.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Ab- hishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024.
Subhashis Ghosal and Aad W van der Vaart. Fundamen- tals of nonparametric Bayesian inference, volume 44. Cambridge University Press, 2017.
Louie Giray.
The problem with false positives: Ai detection unfairly accuses scholars of ai plagiarism. The Serials Librarian, pages 1-9, 2024.
Yann Dubois, Balázs Galambosi, Percy Liang, and Tat- sunori B Hashimoto. Length-controlled alpacaeval: A simple way to debias automatic evaluators. arXiv preprint arXiv:2404. 04470,444555 2024.
Charles Goddard, Shamane Siriwardhana, Malikeh Ehghaghi, Luke Meyers, Vladimir Karpukhin, Brian Benedict, Mark McQuade, and Jacob Solawetz. Arcee's s MergeKit: A toolkit for merging large language models. In Franck Dernoncour, Daniel Freojiuc-Pietre and Anas- tasia Shimorina, editors, Proceedings of the 2024 Con- ference on Empirical Methods in Natural Language Pro- cessing: Industry Track, pages 477-485, Miami, Florida, US, November 2024. Association for Computational Linguistics. doi: 10..665/v1/2024eemlpp-nod 36. URL https:: httpss////llanhhllglyy.o mmllp-industry 36.
Liam Dugan, Daphne Ippolito, Arun Kirubarajan, Sherry Shi, and Chris Callison- Real or fake text?: In- vestigating human ability to detect boundaries between human- written and machine-generate text. In Proceed- ings of the AAAI Conference on Artificial Intelligence, volume 37, pages 12763-12771, 2023.
Aparna Elangovan, Ling Liu, Lei Xu, Sravan Bodapati, and evaluation framework:
Dan Roth. Considers-ther Rethinking human evaluation for generative large lan- guage models. arXiv preprint MiXi::2405.1863: 2024.
Noah Golowich and Ankur Moitra. Edit distance ro- bust watermarks for language models. arXiv preprint Ttt::2006.02333. 2024.
Jaiden Fairoze, Sanjam Garg, Somesh Jha, Saced Mahlouji- far, Mohammad Mahmoody, and Mingyuan Wang. Pub- licly detectable watermarking for language models. arXiv preprint 1rXiv:2310.1844) 2023.
Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bern- hard Schölkopf, and Alexander J Smola. A kernel two- sample test. Journal of Machine Learning Research, 13 (Mar):723-773,, 2012.
Pierre Fernandez, Guillaume Couairon, Teddy Furon, and Matthijs Douze. Functional invariants to watermark large transformers. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 4815 4819. IEEE, 2024.
Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for lan- guage models. arXiv preprint arXiv:2312.044000 2023.
10

---

GaussMark: Structural Watermarking of Language Models
Han Guo, Philip Greengard, Eric P Xing, and Yoon Kim. Lq-lora: Low-rank plus quantized matrix decomposition for efficient language model finetuning. arXiv preprint arXiv:2311.12023, 2023.
Juyong Jiang, Fan Wang, Jiasi Shen, Sungju Kim, and Sunghun Kim. A survey large language models for code generation. arXiv preprint urXiv:2406.00515 2024.
Kayla Jimenez. Professors are using chatgpt detector tools to accuse students of cheating. but what if the software is wrong. USA Today, 2023.
Zeyu Han, Chao Gao, Jinyang Liu, Jeff Zhang, and Sai Qian Zhang. Parameter-efficien fine-tuning for large models: A comprehensive survey, 2024. URL httttss:://arat /arxiv.. brg/abs/2400 2403. 14608.
Nikola Jovanovié, Robin Staab, and Martin Vechev. Water- mark stealing in large language models, arXiv preprint DrXiv:2402.19361 2024.
Joy He- VeeYYuya, Gabriel Poesia, Rose E. Wang, and Noah D. Goodman. Solving math word problems by combining language models with symbolic solvers, 2023. URL https: /wwvvv..vvvv/////v//////////vvvv org/ hbbg/bb/// 2304.09009 02.
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scal- ing laws for neural language models. arXiv preprint arXiv:2001.0836/ 2020.
Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme. Daniel Khashabi, and Yulia Tsvetkov. Semstamp: A semantic watermark with para- phrastic robustness for text generation. arXiv preprint arXiv:2310.03991, 2023.
Enkelejda Kasneci, Kathrin Seßler, Stefan Küchemann, Maria Bannert, Daryna Dementieva, Frank Fischer, Urs Gasser, Georg Groh, Stephan Günnemann, Eyke Hüller- meier, et al. Chatgpt for good? on opportunities and chal- lenges of large language models for education. Learning and individual differences, 103:102274, 2023.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language mod- cls. arXiv preprint arXiv:2106. 09685, 2021.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061-17088 PMLR, 2023a.
Baihe Huang, Hanlin Zhu, Banghua Zhu, Kannan Ramchan- dran, Michael I Jordan, Jason Lee, and Jiantao Jiao. Towards optimal statistical watermarking. arXiv preprint arXiv:2312.00990, 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Anirud- dha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. arXiv preprint (exiv:2336.04632 2023b.
Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Ha- jishirzi, and Ali Farhadi. Editing models with task arith- metic arXiv preprint arXiv:2212.04003 2022.
M Klee. She was falsely accused of cheating with ai-and she won't be the last. Rolling Stone, 2023.
Shima Imani, Liang Du, and Harsh Shrivastava. Math- prompter: Mathematical reasoning using large language models. arXiv preprint NXXIv:2303.05396 2023.
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-fres watermarks for language models. arXiv preprint arXiv:2307. 15593, 2023.
Daphne Ippolito, Daniel Duckworth, Chris Callison-BB Burch, and Douglas Eck. Automatic detection of generated text casiest when humans are fooled. arXiv preprint 1110001911.000500 2019.
Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles, 2023.
Md Rafiqul Islam, Shaowu Liu, Xianzhi Wang, and Guan- dong Xu. Deep learning for misinformation detection online social networks: survey and new perspectives. Social Nenwork Analysis and Mining, 10(1):82, 2020.
Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. Waterfall: Scalable framework for robust text watermark- ing and provenance for llms. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 04432-00466, 2024.
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:23 10. 06855, 2023.

---

GaussMark: Structural Watermarking of Language Models
Lucien Le Cam. Asymptotic methods in statistical decision theory. Springer Science & Business Media, 2012.
Shen Nie, Fengqi Zhu, Zebin You, Xiaolu Zhang, Jingyang Ou, Jun Hu, Jun Zhou, Yankai Lin, Ji-Rong Wen, and Chongxuan Li. Large language diffusion models. arXiv preprint arXiv:2502.09992 2025.
Mina Lee, Megha Srivastava, Amelia Hardy, John Thick- stun, Esin Durmus, Ashwin Paranjape, Ines Gerard- Ursin, Xiang Lisa Li, Faisal Ladhak, Frieda Rong, et al. Evalu- ating Human-language model interaction. arXiv preprint arXiv:2212.09976, 2022.
OpenAL. New ai classifier for indicating ai-written text. OpenAl blog, 2023.
Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, et al. Markllm: An open-source toolkit for IIm watermarking. arXiv preprint arXiv:2405. 10051, 2024.
Erich Leo Lehmann, Joseph P Romano, and George Casella. Testing statistical hypotheses, volume 3. Springer, 1986.
Linyang Li, Botian Jiang, Pengyu Wang, Ke Ren, Hang Yan, and Xipeng Qiu. Watermarking iims with weight quantization. arXiv preprint arXiv:23 12377, 2023a.
Qi Pang, Shengyuan Hu, Wenting Zheng, and Virginia Smith. Attacking Ilm watermarks by exploiting their strengths. arXiv preprint arXhv:2402.16187 2024.
Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Gulrajani, Carlos Guestrin, Percy Liang, and Tat- sunori B. Hashimoto. Alpacaeval: An automatic evaluator of cestruction-follovinn models. https: / //ggttttt hit..b....t... com/tatsu lab/ a paaca_evll, 2023b.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zem- ing Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, perrforrrrm deep learning li- brary. Advances in neural information processing systems, 32, 2019.
Yuqing Liang, Jiancheng Xiao, Wensheng Gan, and Philip S Yu. Watermarking techniques for large language models: A survey. arXiv preprint (00.ii::20000008800 2024.
Martin Pawelczyk, Jimmy Z Di, Yiwei Lu, Ayush Sekhari, Gautam Kamath, and Seth Neel. Machine unlearning fails to remove data poisoning attacks. arXiv preprint arXiv:2406. 17216, 2024.
Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large lan- guage models, 2024a. URL https: /atp:://aaxvvvii org/ abs/2310. 06356.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning reseurch, 21(140): 2020.
Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 2024b.
Saksham Rastogi and Danish Pruthi. Revisiting the ro- bustness of watermarking to paraphrasing attacks. arXiv preprint arXiv:2411.05277 2024.
TG Mathewson. Ai detection tools falsely accuse interna- tional students of cheating. The Markup, 2023.
Yisroel Mirsky, Ambra Demontis, Jaidip Kotak, Ram Shankar, Deng Gelei, Liu Yang. Xiangyu Zhang, Maura Pintor, Wenke Lee, Yuval Elovici, et al. The threat of offensive ai to organizations. Computers & Security, 124: 103006, 2023.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasub- ramanian, Wenxiao Wang, and Soheil Feizi. Can ai- generated text be reliably detected? arXiv preprint wrXhv:2303.11150 2023.
John Schulman, Barret Zoph, Christina Kim, Jacob Hilton, Jacob Menick, Jiayi Weng, Juan Felipe Ceron Uribe, Liam Fedus, Luke Metz, Michael Pokorny, et al. Chatgpt: Optimizing language models for dialogue. OpenAl blog, 2(4). 2022.
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christo- pher D Manning, and Chelsea Finn. Detectgpt: Zero-shot machine- machine-generated text detection using probability curva- ture. In International Conference on Machine Learning, pages 24950-24962. PMLR, 2023.
Mina Schütz, Alexander Schindler, Melanie Siegel, and Kawa Nazemi. Automatic fake news detection with pre- trained transformer models. In Pattern Recognition. ICPR International Workshops and Challenges: Virtual Event, January 10-15, 2021, Proceedings, Part VII, pages 627- 641. Springer, 2021.
Jerzy Neyman and Egon Sharpe Pearson. On the prob- lem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society of Lon- don. Series A, Containing Papers of a Mathematical or Physical Character, (81(694-70))28893 1933.
12

---

GaussMark: Structural Watermarking of Language Models
Pratyusha Sharma, Jordan T Ash, and Dipendra Misra. The truth is in there: Improving reasoning in language models with layer-selective rank reduction. The Twelfth Interna- tional Conference on Learning Representations, 2024.
Hanqing Wang, Yixia Li, Shuo Wang, Guanhua Chen, and Yun Chen. Milora: Harnessing minor singular com- ponents for parameter-efficient Ilm finetuning. arXiv preprint arXiv:2406.0999 09044, 2024.
Mingjie Sun, Zhuang Liu, Anna Bair, and Zico Kolter. A simple and effective pruning approach for large language models. arXiv preprint arXiv:2306. /695, 2023.
Ke Wang, Houxing Ren. Aojun Zhou, Zimu Lu, Sichun Luo, Weikang Shi, Renrui Zhang. Linqi Song, Mingjie Zhan, and Hongsheng Li. Mathcoder: Seamless code integration in llms for enhanced mathematical reasoning. arXiv preprint arXiv:2310.03731, 2023.
Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, et al. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.005 2024.
Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chau- mond, Clement Delangue, Anthony Moi, Pierric Cis- tac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. Transformers: State-of-the-an natural language processing. In Proceedings of the 2020 Conference Empirical Methods in Natural Lan- guage Processing: System Demonstrations, pages 38- 45, Online, October 2020a. Association for Compu- tational Linguistics. URL http::://www.lll///// htt/anthoooggyy2000 2020. demos.. 6.
Adly Templeton, Tom Conerly, Jonathan Marcus, Jack Lind- sey, Trenton Bricken, Brian Chen, Adam Pearce, Craig Citro, Emmanuel Ameisen, Andy Jones, Hoagy Cun- ningham, Nicholas Turner, Callum McDougall, Monte MacDiarmid, C. Daniel Freeman, Theodore R. Sumers, Edward Rees, Joshua Batson, Adam Jermyn, Shan Carter, Chris Olah, and Tom Henighan. Scaling monosemantic- ity: Extracting interpretable features from claude 3 sonnet. Transformer Circuits Thread, 2024. URL ht https: // //transformez Stxrcuits.pub//000 scaling- monosseaattt..iittt/nnne.... html.
Thomas Wolf et al. Huggingface's transformers: State- of-the-art natural language processing. https: //github. wwt. haamm/uggiingg wtwuuggingfaacceett/ffooooo 2020b.
Kat Tenbarge. Parents sue son's high school history teacher over ai 'cheating' punishment, October 2024. Accessed:
2024-12-24.
Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Re- becca Roelofs, Raphael Gontijo-Lppss, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International conference on machine learning, pages 23965-23998. PMLR, 2022.
Jörg Tiedemann, Mikko Aulamo, Daria Bakshandaeva, Michele Boggia, Stig-Arne Grönroos, Tommi Nieminen, Alessandro Raganato, Yves Scherrer, Raul Vazquez, and Sami Virpioja. Democratizing machine translation with opus-mt. arXiv preprint arXiv:2212.019338 2022.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Mar- tinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, al. Llama: Open and efficient foundation language models. arXiv preprint arXiv: 13971, 2023.
Enneng Yang, Li Shen, Guibing Guo, Xingwei Wang, Xi- aochun Cao, Jie Zhang, and Dacheng Tao. Model merging in 1lms, milms, and beyond: Methods, theories, applica- tions and opportunities. arXiv preprins arXiv:2408. 076666, 2024.
Prashnu Verma. A professor accused his class of us- ing chatgpt, putting diplomas in jeopardy. The Wash- ington Post, May 18 2023. URL https:/ www.. washingtonpost.c com. Retrieved July 10, 2023.
Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. Language models are super mario: Absorbing abilities from homologous models as a free lunch. In Forty-first International Conference on Machine Learning, 2024.
Roman Vershynin. High-dimensional probability: An in- troduction with applicatiooss in data science, volume 47.
Cambridge university press, 2018.
Or Zamir. Excuse me, sir? your language model is leaking (information). arXiv preprint 1xXiv:2401.103660 2024.
Alex Wang, Yada Pruksachatkun, Nikita Nangia, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. Superglue: A stickier benchmark for general- purpose language understanding systems. Advances in neural information processing systems, 32, 2019.
Rowan Zellers, Ari Holtzman, Hannah Rashkin, Yonatan Bisk, Ali Farhadi, Franziska Roesner, and Yejin Choi Defending against neural fake news. Advances in neural information processing systems, 32, 2019.
13

---

GaussMark: Structural Watermarking of Language Models
Hanlin Zhang, Benjamin Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. Watermarks in the sand: Impossibility of strong wa- termarking for generative models. arXiv preprint arXiv:2311.0433 1,0378,, 2023.
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306. 2023a.
Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. In International Conference Machine Learning, pages 42187-42199, PMLR, 2023b.
14

---

GaussMark: Structural Watermarking of Language Models
Contents
A. Additional Notation
For any T' 2 0, [T'] denotes the set (I...., T). For a vector v, |e|2 denotes its 22 norms. We denote by Ia the identity matrix in Reddd_ For any set V. A()) denotes the set of all distributions over y. (0, Ia)) represents an isotropic Gaussian distribution in d with variance o². The symbol is used to denote the concatenation of strings of tokens, and @ denotes the product of two distributions (i.e. samples are independent).
B. Related Works
In this section, we discuss the most relevant works on LLM watermarking below, and refer the reader to Liang et al. (2024); Liu et al. (2024b) for a thorough discussion on other watermarking schemes for text, image and audio generation.
Watermarking Approaches with Statistical Guarantees. Watermarking schemes with rigorous statistical guarantees can be broadly categorized as either distorionary or non-distortionary. In the former, the scheme modifies the distribution of the LM's next-token predictions; for example, Kirchenbauer et al. (2023a); Zhao et al. (2023a;b); Aaronson and Kirchner (2022) introduced schemes that partition the vocabulary into a 'red set' and a 'green set,' and adjust the distribution to favor green-set tokens in a manner detectable by examining empirical frequencies of tokens in generated text. While such schemes offer theoretical guarantees, they often lead to significant distortion in the generated text due to token biasing: moreover, they can be quite vulnerable paraphrasing attacks (Rastogi and Pruthi, 2024; Hou al., 2023; Chang al., 2024; Jovanović et al., 2024). We empirically compare GaussMark the scheme introduced by Kirchenbauer et al. (2023a) in Appendix H.
The second category. non- non- -on-disorttonnry schemes, involves concealing the watermarking signal by influencing the pseudo- random number generator (PRNG) involved in sampling individual tokens. Kuditipudi et al. (2023) provide an example of an extremely robust such scheme; unfortunately, it suffers from poor scalability due to the requirement that the length of the watermarking key must be proportional to the number of queries submitted to the model in order to maintain diversity of responses; with the popularity of contemporary LMs, this would lead to impractically large keys and slow detection times. In order to avoid the limitations of Kuditipudi et al. (2023), Christ et al. (2024b) introduce a stronger, cryptographically notion of undetectability and they, along with (Golowich and Moitra, 2024; Zamir, 2024; Fairoze et al., 2023), provide undetectable watermarking schemes that pseudorandomly select the next token using hash function of the preceding k tokens, based on a secret key with provable guarantees both on statistical validity and robustness to token-level corruptions. While important theoretical contributions, these schemes are based on cryptographical primitives that are not yet ready for large-scale deployment in L.M generation due to the resulting increase in generation latency. For example, the scheme of Fairoze et al. (2023) requires hundreds of seconds for generation and detection in contrast to our scheme, which achieves pnders-of-magniuude faster generation and detection speeds for longer token sequences (Figure 3). In contradistinction to the above schemes, GaussMark is white-box, i.c. it requires access to the weights of the LM and is distortionary: however, we empirically demonstrate that the perturbations we introduce do not result in statistically significant decline in model quality.
Other Practical Watermarking Methods. While the above schemes provide strong theoretical guarantees, with the exception of the schemes of Kirchenbauer et al. (2023a;b); Kuditipudi et al. (2023), they have generally not been seriously evaluated empirically. Due to the aforementioned drawbacks of both of these schemes, Dathathri et al. (2024) proposed SynthID-Text, which relies on an efficient implementation of ideas similar to the approach of Christ et al. (2024b): Zamir (2024); Golowich and Moitra (2024), with an additional layer of sophistication with a more involved sampling scheme. While the bespoke implementation on several select models (Gemma 2B, Gemma 7B (Team et al., 2024), and Mistral 7B-IT (Jiang et al., 2023)) is efficient and has relatively low latency, the approach considered empirically unfortunately requires storage costs scaling linearly with the number of tokens generated in order to maintain high quality in generated text. Indeed, similar to the approach of Kirchenbauer al. (2023a), SynthID-Ter Text hashes previous tokens in order to affect the distribution of generation going forward; thus repeated strings of tokens lead to significantly distorted text. While this issue is not as much of problem as in the approach of Kirchenbauer et al. (2023a) due to the fact that sampling remains stochastic in Dathathri et al. (2024), the empirical degree of distortion necessitates storing previous strings of tokens in order to not implement the watermark on such repeated strings; for production-level systems that require maintaining quality and diversity while generating millions of tokens per day, this approach is likely not entirely feasible, Most similar to our
15

---

GaussMark: Structural Watermarking of Language Models
approach is that of the concurrent work Christ et al. (2024a), discussed in the introduction. Fu et al. (2024) provides more practical implementation of Kirchenbauer et al. (2023a) that improves the generation quality by incorporating the semantic structure of the text to partition the token set into corresponding red-lists/ / green-lists.
Post-hoc Detection of Al-generated text. An alternative to developing rigorous watermarking schemes is to design algorithms that can post-hoc distinguish whether a given piece of text is more likely to be Al or fluman-generated e.g. by relying on statistical properties of the text under a given language model (Gehrmann et al., 2019; Mitchell et al., 2023), or by using specifically trained classifiers to discriminate human-text from Al-text (OpenAI, 2023; Zellers et al., 2019). Given the rapid rate of progress in natural language processing, however, the development of better and larger language models will only make post-hoc detection harder (Schütz et al., 2021; Gambini et al., 2022; Sadasivan et al., 2023); furthermore, for a number of applications, such as detecting cheating in scholastic environments, a well-calibrated procedure is essential, which relies on formal statistical guarantees.
Watermarking the model by perturbing weights. Finally, we note that carlier works have considered perturbing model weights to prevent IP theft (Li et al., 2023a; Fernandez et al., 2024; Boroujeny et al., 2024). For example, Aaronson and Kirchner (2022); Li et al. (2023a); Boroujeny et al. (2024) use the gap between the quantized model and the full-precision model to plant the watermarks and Fernandez et al. (2024) use model symmetries to generate an invariant model copy. While our approach also alters the weights of the network, our objective is different from theirs as we want to watermark the generated text instead of the model itself.
Attacks on Watermarked Models. A series of works have demonstrated that adversaries with substantial resources can compromise watermarking schemes. Gu et al. (2023) demonstrate that watermarking schemes can be learned using a student-teacher framework. Kirchenbauer et al. (2023b); Christ et al. (2024b); Pang et al. (2024); Zhang et al. (2023) developed further attacks on watermarking schemes. These attacks are generally resource-intensive often requiring repeated access to an oracle capable of generating high-quality perturbations of input text or evaluating the quality of a given text. Unfortunately, with sufficient resources, an adversary can bypass these schemes entirely by training their own "unwatermarked" AI model to produce content.
Relation to Pawelczyk et al. (2024) The structure of our test statistic in Equation (1) resembles the Gaussian Unlearning Score (GUS) from Pawelczyk et al. (2024) for evaluating the efficacy of machine unlearning algorithms. However, we emphasize a key methodological distinction: while the GUS perturbs data and computes gradients with respect to inputs, our method perturbs model parameters and computes gradients with respect to those parameters, reflecting the distinct goals of unlearning and watermarking. Pawelczyk al. (2024) considers unlearning by aggregating an inner product-based test statistic over multiple data points on models altered by stochastic unlearning process. In contrast, we focus fixed data point and evaluate the likelihood that it was generated by watermarked model. Furthermore, Section 3.1 shows that our test can be viewed as a computationally efficient approximation to the minimax optimal test, providing theoretical grounding for our approach. The resemblance between GUS and GaussMark suggests that the former likely admits a theoretical justification, although this was beyond the scope of that work.
C. Implementation Details
In this section, we provide the details of the implementation of our experiments. As discussed earlier, we use the realnews 1 iike split of the C4 dataset (Raffel et al., 2020); for our experiments, we took the first 1000 samples from this corpus and created prompts by truncating each text at 200 tokens. We considered three models, Mistral-7B, Llama3.1-8B, and Phi3.5-Mini. Each model is a transformer and we apply our watermark to one of the MLP layers in one of the transformer blocks. For Mistral-7B and Llama3.1 1-BB which share an architecture, there are three MLP weights for each layer: down __oji__roo.oo_o up_proj. and pate_ For Phi3.5-Mini, there are two choices of weights per layer: gate_up__t upjproj and down_proj. In all cases, there is final linear layer to which the softmax function is applied get the next token probabilities; we found that directly perturbing this layer led to either negligable detectability of the watermark or an unacceptable decrement of model quality and thus only consider perturbing the MLP weights that are part of the transformer blocks.
In all of our experiments, we used 3 seeds for watermarking the model and generating tokens. The watermarking parameters used to construct the plots the main body of the papers are summarized in Table 2. These parameters were selected by
16

---

GaussMark: Structural Watermarking of Language Models
Model
Watermarked Layer
Watermarked Weight
Variance (a²)
Dimension (d)
Mistral-7B
20
up_proj
le-05
58M
Llama3.1-85
28
up_proj
3e-04
58M
Phi3.5-Mini
20
down_proj
1e-03
25M
Table 2. Selected watermarking hyperparameters.
1.0
1.0
@PR@FPR-
AUC
0.4
0.7
Mistral
Mistral
0.2
Llama
0.6
Llama
Phi
Phi
0.0
0.5
200
400
600
800
1000
200
400
600
800
1000
Number of Tokens
Number of Tokens
(a) TPR al p 0.01 GaussMark.
(b) AUC ROC for GaussMark.
Figure 4. Effect of number of tokens the detectability of GaussMark measured (a) the True Positive Rate p= 0.01 and (b) the AUC of the ROC. As the number of tokens increases, the detectability of the watermark improves, as predicted by the theory.
sweeping over many choices of layer, weight, and variance and for each watermarking parameter evaluating the following: (1) finding the p- p-values of watermark detection on completions of the 1K prompts and (2) evaluating the quality of the watermarked model on SuperGLUE and GSM-8K. For the subset of those models that had acceptably small p-values and had essentially statistically significantly worse performance GSM-8K and SuperGLUE, we then (3) ran the watermarked model through AlpacaEval-2.0 with the unwatermarked model's responses as the comparator. We then chose the watermark parameters for each model those that maximized detectability subject to not hurting performance steps (2) and (3).
D. Empirical Results on Detectability of GaussMark
In this section, we present further results on the detectability of the watermarked models. In Figure 4, we display two different measures of watermark detectability: the true positive rate (TPR) false positive rate (FPR) of p 0.01 and the area under the curve (AUC) of the Receiver Operating Characteristic (ROC) (Carlini al., 2022; Casella and Berger, 2001). We also plot in Figure 5 the ROC curves themselves for each model on different generation lengths of watermarked text. Along with Figure and Figure 2(a), these plots conclusively demonstrate the benefits of longer token sequences for detectability of GaussMark. The trends are consistent across all metrics and models and align well with the theoretical predictions discussed in Section 3.2. Notably, the detectability of the watermark asymptotes as the number tokens increases and predicted by the dimension of
To further evaluate the validity of the simplifying assumptions discussed following Proposition 3.3, we analyze the distribution of gradient norms, v log po (y/ .) for 150 sampled responses across five different prompts for each of the considered models. The distributions are visualized in Figure 6. We see that the gradient norms are relatively tightly concentrated, for Mistral-7B and Hamaa.11-BB in particular, and empirically justify the hypothesis that the gradients lie within a relatively well- coldiioodtt annulus, which a sufficient condition for the alignment of gradient norms. Indeed the multiplicative range of the gradients (i.e. the maximum norm divided by the minimum norm of the responses for each prompt) less than 25 for both Mistral-7B and Llama3.1-88 and less than 40 for
17

---

GaussMark: Structural Watermarking of Language Models
0.8
0.8
Power Test
20 tokens
Power Test
20 tokens
0.6
50 tokens
0.6
50 tokens
100 tokens
100 tokens
200 tokens
200 tokens
300 tokens
300 tokens
500 tokens
500 tokens
0.2
700 tokens
0.2
700 tokens
1000 tokens
1000 tokens
0.0
0.0
0.0
0.2
0.6 Size of Test
0.4
0.8
1.0
0.0
0.2
0.6 Size of Test
0.4
0.8
1.0
(a) ROC for Mistral-7B
(b) ROC for Llama3.1-8B
0.8
Power Test
20 tokens
0.6
50 tokens
100 tokens
200 tokens
300 tokens
500 tokens
0.2
700 tokens
1000 tokens
0.0-
0.0
0.2
0.6 Size of Test
0.4
0.8
1.0
(c) ROC Phi3.5-Mini
Figure 5. Efffect of number of tokens the delectability of GaussMark measured by the ROC for (a) Mistral-7B, (b) Llama3.1-8B, and (c) Phi3.5-Mini. As the number of tokens increases, the ROC curve shifts to the left, indicating better detcctability. The trivially achievable ROC curve random test shown gray for comparison.
Finally, we report the median p-values of watermarked text generated from the 1K prompts for many different choices of layer, variance, and weight matrix for each of the three considered models in Figure 7, Figure and Figure 9. As expected, when the variance is too small, the p-values are large, indicating that the watermark signal is insufficiently strong. Perhaps surprisingly, when the variance is too large, there is similar increase in p-values. We conjecture that this latter effect is caused by the fact that the linear softmax approximation is local and the quality of this approximation degrades as the norm of & increases; thus the extent to which the conclusion of Proposition 3.3 applies attenuates when the variance too large.
E. Empirical Results on the Quality of Watermarked Models
We here provide additional results the effect that GaussMark has the downstream model performance. We begin by reporting the SuperGLUE scores of the both the watermarked and unwatermarked models broken down by the 8 individual tasks that make up the benchmark. We report the average score and the standard error as computed by in-evaluatto uatiionhaareess (Gao et al., 2024) for each model Table 4, Table 5, and Table 6. We see that the watermark has negligible effect on the performance the models on the SuperGLUE benchmark, which is precisely why these particular watermarking parameters were chosen.
18

---

GaussMark: Structural Watermarking of Language Models
35
30
Prompt 0
Prompt
30
Prompt
25
Prompt
Prompt
Prompt
25
Frequency
Prompt 3
Frequency
20
Prompt 3
20
Prompt
Prompt
15
15
10
10
5
5
0
0
1000
2000
3000
4000
5000
6000
7000
500
1000
1500
2000
Gradient Norm
Gradient Norm
Gradient Norm Distribution for Mistral-7B.
Gradient Norm Distribution for Llama3.
30
Prompt
25
Prompt
Prompt 2
Frequency
20
Prompt. 3
Prompt 4
15
10
5
0
100
200
300
400
Gradient Norm
(c) Gradient Norm Distribution Phii.5-Mini.
Figure Distribution of Po (yl =)] for different prompts (a) Mistral-7B, (b) Llama3.1-8B. and (c) Phi3.5-Mini. The relatively tight concentration of the gradient norms serves to justify the linear softmax approximations per the discussion following Proposition 3.3.
In addition SuperGLUE, GSM-8K, and AlpacaEval-2.0,, we also measure the decline in model quality through erossen- tropy actual text. In particular, for each of the 1K samples in corpus, compared the per-token crossentropy of the unwatermarked models with those of the watermarked models (as well as the Rank-reduced version, ef. Appendix G). We in Table 3 that there is essentially difference in next-token prediction abilities between watermarked and unwatermarked models, providing further evidence that GaussMark does not negatively affect the performance of the model.
Finally, analogous to the ablation in Appendix D where we demonstrate the effect that different choices of watermarking parameters have on the detectability the watermark, in Figures 10 we show effect that these identical variations have on the performance of the models on GSM-8K benchmark. The plots are colored so as clearly display which variations statistically indistinguishable from the base model (yellow) and which not (purple). For the sake of brevity, restrict attention to the math benchmark opposed the individual SuperGLUE tasks, although the general trend persists across tasks. Unsurprisingly, the variance parameter increases and the watermarked model becomes more different from the unwatermarked model, the performance decreases. Interestingly, the middle layers appear to be the most noise-robust Mistral-7B and Llama3.1-8B, with layers near the top and bottom being able to handle substantially less perturbation. addition, variance than either of the other two models.
appears to be substantially more noise-robuss and can tolerate significantly higher
19

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1e:04
3e-04
1e-03
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.0000
0.0000
0.0000
0.0000
0.0000
Layer 31
0.0000
0.0000
0.0000
0.0000
0.0000
Layer 30
0.0008
0.0000
0.0000
0.0000
0.0000
Layer 30
0.0000 0.0000
0.0000
0.0000
0.0000
Layer 29
0.0001 0.0000 0.0000 0.0000 0.0000
Layer 29
0.0000 0.0000 0.0000 0.0000 0.0000
Layer 28
0.0002 0.0000 0.0000 0.0000 0.0000
Layer 28
0.0001 0.0000 0.0000 0.0000 0.0000
Layer 25
0.0000 0.0000 0.0000 0.0000
0.0000
Layer 25
0.0000 0.0000 0.0000 0.0000 0.0000
Layer 20
0.0000 0.0000 0.0000 0.0000 0.0000
Layer 20
0.0000 0.0000 0.0000 0.0000 0.0000
Layer 10
0.0011 0.0006 0.0016 0.0048 0.0193
Layer 10
0.0017 0.0003 0.0016 0.0009 0.0237
(a) Mistral-7B median p-values (down_proj)
(b) Mistral-7B median p-values (up_proj)
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.0000
0.0000
0.0000
0.0000
0.0000
Layer 30
0.0002
0.0000
0.0000
0.0000
0.0067
Layer 29
0.0007 0.0000 0.0000 0.0000 0.0146
Layer 28
0.0008 0.0000 0.0000 0.0000 0.0010
Layer 25
0.0005 0.0000 0.0000
0.0000 0.0000
Layer 20
0.0005 0.0000 0.0000 0.0000 0.0000
Layer 10
0.0078 0.0010 0.0105 0.0287 0.1523
(c) Mistral-7B median p-values (rot
Figure 7. Detectability of watermarked Mistral-7B models with GaussMark for different layers and variances as measured by the median p-value over IK prompts for (a) down_proj (b) up_proj, and (c) gate_proj, colored by value.
F. Empirical Results on the Robustness of GaussMark
In addition to statistical validity, detectability, and lack of model degradation, an important property of a watermarking scheme is its robustness to corruption. In many applications, the watermarked text may be modified in some ways, either intentionally (e.g. to evade plagiarism accusations) unintentionally (e.g. when only portion of model's output is included in the final draft of paper). Consequently, for watermark to be practical, it must demonstrate least some degree of robustness to such changes.
We consider four kinds of corruptions commonly discussed in the watermarking literature (Kuditipudi et al., 2023; Christ et al., 2024b; Liu et al., 2024a; Zhao et al., 2023a; Golowich and Moitra, 2024): three types of token-level corruptions (random insertions, deletions, and substitutions) and more challenging paraphrasing attack-namely. 'roundtrip translation," where watermarked text is translated into another language and then back English. Details of the token-level corruptions provided below:
Random insertions. We choose random tokens from the vocabulary and insert them into the text. We either insert these tokens at random locations or as prefix, with the latter simulating some degree of ignorance of the prompt itself.
Random deletions. We choose random tokens from the text and delete them. We also consider deleting the first few tokens of the text to understand whether or not knowledge of the prompt is necessary for GaussMark to detect the watermark.
20

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1e:04
3e-04
1e-03
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.0000
0.0000
0.0000
0.0000
0.0000
Layer 31
0.0019
0.0000
0.0000
0.0000
0.0000
Layer 30
0.0379
0.0011
0.0000
0.0000
0.0000
Layer 30
0.0966
0.0072
0.0000
0.0000
0.0000
Layer 29
0.0488
0.0054
0.0000
0.0000 0.0000
Layer 29
0.2075
0.0482
0.0008
0.0000 0.0000
Layer 28
0.1403
0.0292
0.0003
0.0000 0.0000
Layer 28
0.1238
0.0263
0.0003
0.0000 0.0000
Layer 25
0.0830
0.0154
0.0002
0.0000 0.0000
Layer 25
0.1275
0.0253
0.0006
0.0000 0.0000
Layer 20
0.0867
0.0099
0.0000 0.0000 0.0000
Layer 20
0.0993
0.0126
0.0001 0.0000 0.0000
Layer 10
0.0873
0.0156
0.0003 0.0000 0.0004
Layer 10
0.1160
0.0195
0.0007 0.0001 0.0017
(a)
Llama3.1-8B median p-values (down_proj)
(b) Llama3. 1- median p-values (up_proj).
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.1 166
0.0216
0.0001
0.0000
0.0000
Layer 30
0.1713
0.0624
0.0037
0.0000
0.0000
Layer 29
0.1989
0.0959
0.0059
0.0000 0.0000
Layer 28
0.1976
0.0802
0.0051
0.0001 0.0000
Layer 25
0.1817
0.0710
0.0066
0.0001 0.0000
Layer 20
0.2244
0.0729
0.0054
0.0001 0.0000
Layer 10
0.1900
0.0798
0.0093
0.0007 0.0017
(c) Llama3.1 1.maa median p-values (gate_proj).
Figure 8. Detectability of watermarked Llama3.1 models with GaussMark for different layers and variances as measured by the median p-value over IK prompts for (a) down_prop (b) up_ popjr and (c) gate p_oj_ colored by value.
Random substitutions. We choose random tokens from the vocabulary and substitute them for tokens in the text. We consider both random substitutions and substitutions of the first few tokens of the text.
For these token-level attacks, Figure 13 (a)-(c) illustrates how the percentage of watermarked text detected at the p = 0.05 level by GaussMark. Detect decreases as progressively larger fractions of the text are corrupted. The results indicate that the degree of robustness varies significantly depending on both the model and the type of corruption, with Llama3.1-8B being sufficiently robust as retain significant detection power with half of the tokens corrupted. However, emphasize that these token-level attacks are relatively crude and do not reflect realistic threat models, as the quality of the corrupted text degrades considerably. Thus, following Kuditipudi et al. (2023), we consider more realistic paraphrasing attack, where we use Helsine nk -NLP et al., 2022) to translate watermarked text from English to French and back. We then evaluate the impact of this roundtrip translation on the detectability of GaussMark. Figure 13-(d) presents the ROC curves for each model following roundtrip translation through French. Despite the increased difficulty of this attack, all models demonstrate nontrivial detection power, demonstrating some robustness in this more realistic corruption scenario.
-ee.-c--iiii----ee fr e and Hel sinkknikk innk-iii -NLP / aepus-mt-bee -etesmtttttiiiie settttttt-igg--eeeeteeeee fr-nn (Tiedemann
Finally, we note that in its most basic form, GaussMark. Deteet requires knowledge of the prompt. Indeed, the detection procedure is predicated on the assumption that we can take the gradient of the log probabilities of the generated tokens conditional on the input. Because such knowledge is rarely available practice, in Figure 14 we investigate the effect that inserting, deleting, and substituting tokens at the beginning of the concatenation of the input prompt and the generated text has on detectability, We see that GaussMark extremely robust to ignorance of the prompt, with the median p-values of the
21

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1e:04
3e-04
1e-03
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.0130
0.0001
0.0000
0.0000
0.0000
Layer 31
0.2620
0.1290
0.0188
0.0001
0.0000
Layer 30
0.3106
0.2389
0.0844
0.0111
0.0001
Layer 30
0.2737
0.1526
0.0412
0.0015
0.0000
Layer 29
0.1966
0.0265
0.0122
0.0077
0.0047
Layer 29
0.2948
0.1757
0.0607
0.0036
0.0009
Layer 28
0.4543
0.3561
0.2060
0.0567
0.0008
Layer 28
0.3174
0.2133
0.0742
0.0099
0.0000
Layer 25
0.2985
0.2208
0.0616
0.0072 0.0055
Layer 25
0.3503
0.2336
0.1041
0.0145
0.0001
Layer 20
0.3211
0.2141
0.1000
0.0158 0.0002
Layer 20
0.3408
0.2286
0.0947
0.0101
0.0000
Layer 10
0.3109
0.2481
0.1259
0.0337 0.0015
Layer 10
0.3442
0.2300
0.0777
0.0101
0.0004
(a) Phi3.5-Mini median p-values (down_proj).
(b) Phi3.5-Mini median p-values (gate_up_proo)
Figure 9. Detectability of watermarked Phi3.5-Mini models with GaussMark for different layers and variances measured by the median p-value over IK prompts for (a) down_proy and (b) sate__p__roop colored by value.
Model
Unwatermarked
Vanilla GaussMark
Bank-Reduced GaussMark
Mistral
1.9199 = 0.0135
1.9385 = 0.0134
1.9410 0.0135
Llama
2.1709 # 0.0149
2.2331 # 0.0145
2.1901 0.0148
Phi
2.1396 + 0.0133
2.1617 0.0133
2.1620 0.0133
Table 3. Comparison of crossentropies of GaussMark to unwatermarked models on C4.
watermarked text remaining relatively stable across different prompt corruptions. Indeed, because removing tokens from the concatenation of the prompt and LM's response results in significantly shorter sequences, we see by comparing Figure 14(b) to Figure 2(a) that much of the attenuation detection power is due to the shorter length of the sequences rather than the corruption itself.
We conclude this section by summarizing our experiments the robustness of GaussMark and the key takeaways. In Figure 15 and 16, along with Figure 13 and 14 we display the results of these token-level corruptions. In particular, we replace increasing fractions of the watermarked text with the corrupted text and measure the effect on the TPR at FPR of 0.05 as well as the median p-values and the AUCs of the resulting tests. We find that all of the measures generally agree in terms of the effect that such corruption has on the detectability of GaussMark. First, when substantial fractions of the text are substituted or removed, we find that the detectability of GaussMark negatively affected. On the other hand, corruptions the prompt itself, including removing half of the concatenated prompt and generated response, have very little effect, demonstrating the robustness of GaussMark to ignorance of the prompt. We emphasize that these token-level corruptions should only be seen preliminary analysis. On one hand, they are too simplistic to encompass the range of techniques motivated attacker might employ. On the other hand, they are overly aggressive, as the resulting corrupted text of extremely low quality.
G. Can GaussMark be Improved with Rank-reduction?
As discussed previously, the key challenge in applying GaussMark is identifying the appropriate parameters 0 which to add noise, taking into account the careful balance between detectability and model quality. Recent empirical work has observed that the highest principal components of LMs' weight matrices are maximally significant in determining model predictions (Hu et al., 2021; Sharma et al., 2024; Dettmers et al., 2024; Guo et al., 2023; Han et al., 2024; Wang et al., 2024). with Sharma et al. (2024) in particular suggesting that the lower principal components of the weight matrices can be treated as "noise' and their removal can even improve model performance on some tasks. Motivated by these observations, we propose a rank-reduced version of GaussMark wherein we let ④ be the subspace spanned by the lower principal components
22

---

GaussMark: Structural Watermarking of Language Models
Task
Llama
Llama (Unwatermarked)
BoolQ
0.8223 0.0067
0.8217 * 0.0067
CB
0.6607 0.0638
0.6250 = 0.0653
COPA
0,9000 0.0302
0,8700 = 0.0338
MultiRC
0.5718 0.0071
0.5720 0.0071
ReCoRD
0.9168 0.0027
0.9222 0.0026
RTE
0.6931 0.0278
0.7040 0.0275
WIC
0.5047 0.0198
0.5157 0.0198
Winograd
0.6058 0.0482
0.5865 0.0485
Table Performance GaussMark on SuperGLLUELLams31--B))
Task
Mistral
Mistral (Unwatermarked)
BoolQ
0.8162 = 0.0068
0.8205 0.0067
CB
0.6071 = 0.0659
0.5357 = 0.0672
COPA
0.9100 = 0.0288
0.9200 = 0,0273
MultiRC
0.5590 = 0.0071
0.5672 = 0.0071
ReCoRD
0.9203 = 0.0027
0.9219 = 0.0026
RTE
0.7112 = 0.0273
0.6823 0.0280
WiC
0.5831 0.0195
0.5674 0.0196
Winograd
0.5192 = 0.0492
0.4615 0.0491
Table 5, Performance of GaussMark on SuperGLUE (Mistral-7B).
of given parameter matrix.!.
The rank-reduced instantiation of GaussMark is motivated by the empirical observation that the top Principal Components (PCs) of the MIP weights in transformers are often sufficient to obtain strong performance in modern LMs. Thus, for a given weight matrix with rank m, we compute the projection onto the bottom m - k PCs, where k is a hyperparameter we select. Thus, we only add the perturbations & to the bottom m k principle components. Increasing k better preserves the model's performance, as the effect of the watermark perturbation is restricted to less influential and lower dimensional space; at the same time, choosing i too large leads to a significantly less detectable watermark. We then compute the gradient by projecting the gradient of the weight matrices onto this lower dimensional space as well for use in GaussMark. The specific watermarking hyperparameters we employ detailed in Table 7.
We find that this rank annureddced version of GaussMark allows for significantly more noise to be added without compromising model quality (as measured by the metrics discussed in Section 4.2). In Figure 17(a), we plot the fraction of detected watermarked responses at p 0.05 for the rank-reduced version of GaussMark averaged over seeds for each model for a variety of response lengths, and observe a similar trend as in the vanilla instantiation GaussMark (cf. Figure 2(a)). In Figure 17(b), we demonstrate that by further reducing the rank of the watermarking space, we are able tolerate significantly greater variance without affecting model performance on GSM-SK. This trend persists on all our models and metrics and is discussed greater length, along with many more empirical observations. Finally, while the rank-reduction approach serves to occasionally improve the quality of generations with sacrifice in watermark detectability, we observe that the sank-reduced watermarks investigated here are less robust to corruption than the vanilla instantiation of GaussMark (e.g., compare Figure 13 to Figure 22). Whether this is an inherent feature of the rank-reduction or a result of the specific parameters chosen is an interesting question for future research.
An alternative approach more directly inspired by the results of Sharma et al. (2024) would be to first project the weight matrix onto its top principal components and then add small amount of noise to the bottom components. While we did experiment with this technique, and observed that heneficial from the perspective of detectability and SuperGLUE, we found that performed extremely poorly on AlpacaEval Eval-2.0 and thus not report here.
23

---

GaussMark: Structural Watermarking of Language Models
Task
Phi
Phi (Unwatermarked)
BoolQ
0.8514 = 0.0062
0.8532 # 0.0062
CB
0.0893 = 0.0385
0.0893 = 0.0385
COPA
0.8800 = 0.0327
0,8700 = 0.0338
MultiRC
0.3855 = 0.0070
0.3296 0.0068
ReCoRD
0.8689 = 0.0033
0.8725 0.0033
RTE
0.7509 0.0260
0.7509 0.0260
WIC
0.5768 0.0196
0.5752 = 0.0196
Winograd
0.7885 0.0402
0.8269 = 0.0373
Table 6. Performance of GaussMark on SuperGLUUE(hi..5MMMn)
Model
Watermarked Layer
Watermarked Weight
Variance (o²)
# PCs Dropped
Mistral-7B
30
ur_p
Ic-05
1024
Llama3.1-8B
29
down_proj gate_up_proj
le-04
512
Phi3.5-Mini
31
3e-04
1024
Table Selected watermarking hyperparameters.
G.1. Defectability
While in Figure 17(a) we displayed the TPR an FPR of 0.05, here present the same at an FPR of 0,01 (Figure 18(a)) and the median p-values (Figure 18(b)) the number of tokens increases. As in the case of the vanilla instantiation of GaussMark (ef. Appendix D), all detectability metrics broadly agree and demonstrate that the watermark remains detectable even with the rank-reduction.
Analogous to the exhaustive search over watermarking hyperparameters that we presented in Figures 7 to 9, we present in Figure 18 an abbreviated version of a similar search for the rank-reduced models, with a special focus on the effect that projecting away different ranks of PCs has on the median p-value. As predicted by our theory, projecting away more PCs leads less detectable watermark, both due to a decrement in the gradient norm and a reduction in the "effective dimension" of 6. As in the vanilla instantiation, we that increasing variance generally leads more detectable watermark, with the caveat that too large variances reduce the verisimilitude of the linear softmax approximation, and can thus lead MaussMark to be less detectable.
G.2. Model Quality
We now report the effect that the rank-reduced instantiation of GaussMark has on model quality in each of our measurements thereof: SuperGLUE, AlpacaEval-2.00 GSM-SK, and token-level cross-entropy. As we did in Appendix E, we begin by demonstrating that our selected models, whose watermarking parameters are given Table do not suffer comparison to the unwatermarked versions. The cross-entropy is reported in Table 3, whereas the other metrics are reported in Table 8, with detailed SuperGLUE results broken down by task in Tables 5, 9 and 11. all cases, we see that we can find watermarking hyperparameters that do significantly affect the model's performance while retaining detectability.
In addition to our model quality checks for the selected models, report in Figure 20 the effects that rank reduction and variance have on GSM-8K performance for fixed weights and layers for each model. Along with Appendix G.2, these results demonstrate that rank reduction is an effective technique in allowing the watermarked models to tolerate greater variance ²² while maintaining quality.
G.3. Robustness
Finally, we present the effect that our three token-level corruptions and one semantic level corruption have on the rank- reduced instantiation of GaussMark. The latter of these displayed in the ROC curves in Figure 21, whereas the former are displayed as measured by the TPR at FPR = 0.05 (Figure 22), median p-values (Figure 23), and as AUC under the ROC (Figure 24).
24

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1e:04
3e-04
1e-03
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.3707
0.3306
0.2183
0.0000
0.0000
Layer 31
0.3942
0.3237
0.1410
0.0182
0.0000
Layer 30
0.4367
0.4405
0.4185
0.2494
0.0000
Layer 30
0.4344
0.4397
0.3995
0.0462
0.0000
Layer 29
0.4405
0.4443
0.4215
0.2904
0.0000
Layer 29
0.4094
0.3958
0.3662
0.2411
0.0000
Layer 28
0.4253
0.4139
0.3867
0.2669
0.0000
Layer 28
0.4359
0.4230
0.3935
0.2381
0.0000
Layer 25
0.4276
0.4139
0.3639
0.1706 0.0000
Layer 25
0.4284
0.4291
0.3874
0.1797
0.0000
Layer 20
0.4215
0.3571
0.1471
0.0053 0.0000
Layer 20
0.4321
0.4102
0.3048
0.0409
0.0000
Layer 10
0.3571
0.1903
0.0000 0.0000 0.0000
Layer 10
0.3851 0.2760
0.0182
0.0053 0.0000
(a) GSM-8K performance of Mistral-7B (down_proj).
(b) GSM-8K performance of Mistral-7B (up_proj).
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.4337
0.4139
0.3829
0.0015
0.0000
Layer 30
0.4223
0.4086
0.3078
0.0000
0.0000
Layer 29
0.4026
0.3533
0.2805
0.0000
0.0000
Layer 28
0.4367
0.4337
0.0000
0.0000
0.0000
Layer 25
0.4344
0.4230
0.3632
0.0129
0.0000
Layer 20
0.4428
0.4344
0.3275
0.0008 0.0000
Layer 10
0.4261
0.3692
0.0781
0.0068 0.0000
(c) GSM-8K performance of Mistral-7B (gate_pro)).
Figure 10. Effect that GaussMark has on Mistral-7B's performance on GSM-8K for different layers and variances for (a) down_projj, (b) up_proj. and (c) gate_proj, colored by whether the watermarked model's performance is statistically indistinguishable from that of the base model (yellow) or not (purple).
Finally, we present the impact of our three token-level corruptions and one semantic-lewe corruption on the rank-reduced instantiation of GaussMark. The effect of semantic-leved corruption is illustrated in the ROC curves shown in Figure 21, while the token-level corruptions and AUC under the ROC (Figure 24). In all cases, we continue to see some robustness to both roundtrip translation and token-level corruptions, although if we compare these results to our earlier results for the vanilla instantiation of GaussMark, we see that the vanilla instantiation is generally more robust.
evaluated using the TPR FPR p = 0.05 (Figure 22), median p-values (Figure 23),
H. Empirical Comparison with Other Watermarking Schemes
In this section, we compare the Soft Red List approach of Kirchenbauer et al. (2023a:b) with our GaussMark. As we discussed in the main text, the approach of Dathathri et al. (2024) does not provide statistically valid watermark as implemented and thus we do not compare with it. While the approach of Kuditipudi et al. (2023) does provide statistically valid watermarks, the detection times as reported in the text are orders of magnitude greater than those of GaussMark; furthermore, for realistic scenarios, wherein provider may wish to service many clients with similar prompts and diverse responses, the corresponding growth in detection time of Kuditipudi et al. (2023) is prohibitive (quadratic in terms of number of queries) and thus we restrict our empirical comparison to the unique pre-existing practical watermarking approach of
25

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1e:04
3e-04
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.5269
0.4587
0.3707
0.1205
0.0000
Layer 31
0.6103
0.6133
0.5944
0.4829
0.0440
Layer 30
0.6217
0.6224
0.6126
0.6126
0.5641
Layer 30
0.6293 0.6361
0.6255
0.6133
0.3434
Layer 29
0.6217 0.6285
0.6156
0.6058
0.5747
Layer 29
0.6346 0.6323
0.6406
0.6338
0. 0.6232
Layer 28
0.6187 0.6156
0.6035
0.5997
0.5959
Layer 28
0.6331 0.6285
0.6187
0.6111
0.6012
Layer 25
0.6194 0.6141
0.6126
0.6042
0.5777
Layer 25
0.6262 0.6293
0.6323
0.6118
0.5891
Layer 20
0.6171 0.6270
0.6338
0.6171
0.5057
Layer 20
0.6270 0.6331
0.6331
0.6111
0.4898
Layer 10
0.6270 0.6065
0.5254 0.2775
0.0053
Layer 10
0.6217 0.6035
0.5262 0.2775
0.0129
(a) GSM-8K performance of Llama3.1-8B (down_proj)
(b) GSM-8K performance of Llama3 1-8B (up_proj).
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.6202
0.6133
0.6020
0.5898
0.5603
Layer 30
0.6240 0.6247
0.6240
0.6232
0.6027
Layer 29
0.6277 0.6277
0.6262
0.6187
0.6164
Layer 28
0.6224 0.6217
0.6262
0.6187
0.6133
Layer 25
0.6270 0.6331
0.6293
0.6202
0.5959
Layer 20
0.6285 0.6179
0.6088
0.6149 0.5982
Layer 10
0.6224 0.6050 0.5792 0.4587 0.1350
(c) GSM-8K performance of Llama3.1 B-B (gate_prop) _roj)_
Figure 11. Effect that GaussMark has on Llama3. 1-B8's performance on GSM-8K for different layers and variances for (a) Jown_proj, (b) up_proj. and (c) gate_proj, colored by whether the watermarked model's performance is statistically indistinguishable from that of the base model (yellow) or not (purple).
which we aware that has formal statistical guarantees.
The Soft Red List approach described by Kirchenbauer et al. (2023a;b) selects pseudo-random hash function based on the previous yn tokens to identify a random 7-fraction of the token space. A constant 5 is then added to the log probabilities of these selected tokens before sampling. Under this scheme, the unwatermarked text is expected to exhibit, on average, YT many "upweighted" tokens, so if significantly more favored tokens appear in a given text is likely that the text watermarked; Kirchenbauer al. (2023a) proposes z-test detect this signal in statistically quantifiable way. Following prior empirical studies (Dathathri et al., 2024; Kuditipudi al., 2023), we set 7 = 0.25 and evaluate the approach with 6 1.0 and å= = 2.0. Note that there is tradeoff in increasing 8; A higher 8 strengthens the detectability of the watermark, though may lead to greater distortion of the generated text.
As in Kuditipudi et al. (2023), we refer to this scheme as KGW-1 and KGW-2 depending on whether 5 = 1.0 or 2.0, respectively. In our timing plots (Figure 27), we refer to this approach simply as KGW. As the performance of KGW not the main focus of this work, for the sake of saving expensive computational resources, we evaluated KGW only on 100 used to evaluate GaussMark. In Figures 25 and 26, we compare the detectability
prompts as opposed to the 1K prompts of GaussMark to KGW-1 and KGW-2 on Llama3.1 1-BBB, Mistral-7B, and Phi3.5-Mini. These comparisons are based on metrics such as the median valuue and AUC of the ROC curve (Figure 25), as well as the fraction of significant detections at
We observe that technically the guarantees of Kirchenbauer et al. (2023a;h) only give approximate p-values; clide this point and treat them as formal for the purposes of this comparison.
26

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Layer 31
0.8499
0.8469
0.8332
0.7695
0.6558
Layer 31
0.8506
0.8537
0.8544
0.8605
0.8408
Layer 30
0.8453
0.8438
0.8469
0.8415
0.7930
Layer 30
0.8537
0.8476
0.8506
0.8438
0.8415
Layer 29
0.8484
0.8400
0.7309
0.7316
0.7491
Layer 29
0.8469 0.8415
0.8385
0.8393 0.8173
Layer 28
0.8514 0.8499
0.8506
0.8560
0.8529
Layer 28
0.8499 0.8537 0.8499
0.8575
0.8529
Layer 25
0.8461 0.8453
0.8438
0.8453 0.8150
Layer 25
0.8400 0.8506 0.8484
0.8446
0.8218
Layer 20
0.8544 0.8552 0.8529 0.8567 0.8552
Layer 20
0.8476 0.8415 0.8423 0.8370
0,8180
Layer 10
0.8552 0.8544 0.8506 0.8537 0.8385
Layer 10
0.8461 0.8431 0.8309 0.8287 0.7544
(a) GSM-8K performance of Phi3.5-Mini (down_proj).
(b) GSM-8K performance of Phi3.5-Mini
Figure 12. Effect that GaussMark has on Phi3.5-Mini performance on GSM-8K for different layers and variances for (a) down_prop and (b) _ate_up__prg_ a, colored by whether the watermarked model's performance statistically indistinguishable from that the base model (yellow) or not (purple).
Model
SuperGLUE(AAg)
GSM8K (Acc)
Alpaca Eval (win rate)
Llama3.1-88 (LowRank)
0.6992 = 0.0337
0.6133 = 0.0134
0.47
Llama3.1-85 (Unwatermarked)
0.7012 = 0.0336
0.6300 0,0133
(0.46, 0.54)
Mistral-7B (LowRank)
0.6796 0.0336
0.4253 0.0136
0.50
Mistral-7B (Unwatermarked)
0.6836 0.0335
0.4291 = 0.0136
(0.49, 0.51)
Phi3.5-Mini (LowRank)
0.6384 = 0.0258
0,8537 = 0.0097
0.47
Phi3.5-Mini (Unwatermarked)
0.6451 = 0.0254
0.8423 # 0.0100
(0.46, 0.54)
Table 8. Performance of GaussMark on various models.
FPR 0.05 and 0.01 (Figure 26), averaged across three seeds. Consistent with our experiments on detectability in Appendix D and Appendix G.I, we see that each of these metries broadly agrees with the others.
The weaker of the soft Red list implementations (KGW-1) expresses broadly similar performance GaussMark with some variation in the model and the choice of measurement. The stronger implementation (KGW-2) evinces superior detectability. In both cases, however, this detectability comes at a serious computational cost in generation time, as shown in Figure 27. While the detection times are broadly similar to those of GaussMark, the generation times are orders of magnitude greater. While in all cases we use 40GB NVIDIA A100s in our experiments, one reason for this vast disparity is the use of Huggingface's generation code (Wolf et al., 2020b), as opposed to the accelerated vLLM codebase (Kwon et al., 2023). While this may not seem like a fair comparison at first glance, one of the key advantages of GaussMark is that LM decoding acceleration code can be used out of the box to generate high-quality watermarked text opposed requiring bespoke implementations for each watermarking scheme and model. This is significant advantage in practice, it allows for the rapid deployment of GaussMark across a wide variety of models and use cases.
We also compare the quality of text generated by KGW-1 and KGW-2 to that of GaussMark using AlpacaEval-2.00 with the results summarized in Table 12. We see that in all cases either GaussMark or its rank-reduced version improves on the performance of KGW, sometimes significantly. The more distortionary scheme, KGW-2, fairs particularly poorly this comparison. We reiterate that we did not conduct a fully exhaustive search over the possible parameter combinations to apply GaussMark and suspect that improved performance could be had with further search.
Finally, we compare the robustness of KGW-1 and KGW-2 to GaussMark in Figures 28 and 29. In Figures 28(a), 28(c) and 28(c), we present the effects of adding random tokens to each watermark. Similarly, Figures 28(b), 28(d) and 28(() illustrates the impact of removing random tokens, while Figures 29()), 29(c) and 29(e) examines the effects of substituting random tokens. Across all cases, we evaluate the effect on the true positive rate (TPR) at a false positive rate (FPR) of 0.05, as our earlier experiments have shown that all measurements of detectability generally agree. We see that KGW-1 and
27

---

GaussMark: Structural Watermarking of Language Models
Task
Llama (LowRank)
Llama (Unwatermarked)
BoolQ
0.8205 0.0067
0.8217 0.0067
CB
0.5893 0.0663
0.6250 0.0653
CОРА
0.8700 0.0338
0.8700 0.0338
MultiRC
0.5720 0.0071
0.5720 0.0071
ReCoRD
0.9221 0.0026
0.9222 0.0026
RTE
0.7076 0.0274
0.7040 0.0275
WiC
0.5063 0.0198
0.5157 0.0198
Winograd
0.6058 0.0482
0.5865 0.0485
Table Performance GaussMark on SuperGLLUELLamaa31--80 LowRank).
Task
Mistral (LowRank)
Mistral (Unwatermarked)
BoolQ
0.8199 = 0.0067
0.8205 + 0.0067
CB
0.4821 = 0.0674
0.5357 + 0.0672
CОРA
0.9200 = 0.0273
0.9200 = 0.0273
MultiRC
0.5693 = 0.0071
0.5672 + 0.0071
ReCoRD
0.9198 = 0.0027
0.9219 + 0.0026
RTE
0.6570 = 0.0286
0.6823 + 0.0280
WiC
0.5690 = 0.0196
0.5674 + 0.0196
Winograd
0.5000 = 0.0493
0.4615 + 0.0491
Table 10. Performance of GaussMark on SuperGLLUEMMistrrl-711 LowRank).
KGW-2 are significantly more robust to token-level corruptions than GaussMark. This result is not altogether surprising in light of the fact that we used a context window of a single token for the KGW experiments, which allows for significant textual distortion; indeed, Kuditipudi et (2023) report considerable increase perplexity when using KGW as well as concurrent decline in the quality of the generated text, especially when prompted to follow instructions. Furthermore, we described in Appendix F, these token-level attacks are not very realistic given the strong negative effects they have on text quality. A more realistic attack is the roundtrip translation attack, whose results display in Figures 29(b), 29(d) and 29(() as ROC curves, with corresponding AUC values summarized in Table 13. Here we see that GaussMark performs better than KGW-1 on Llama3.1-85 and Mistral-7B and comparably on Phi3.5-Mini. Although KGW-2 demonstrates improved robustness, we again note that the amount of distortion introduced by KGW-2 is unacceptably high, as reported by Kuditipudi et al. (2023).
Theoretical Analysis
In Appendix 1.1, we provide the missing details from Section 3, including a formal proof of the bound on the expected deviation under the null hypothesis for the Gaussian example. We then present the proof of Proposition I.2, which highlights the form the hypothesis in Ho that is closest to HA. In Appendix I.2, we establish the statistical guarantees on the level of the test (Proposition 3.1). Next, Appendix I.3 contains proofs for the claims regarding the power of the test, with results on the linear softmax distribution detailed in Appendix I.3.1. Additionally, we discuss the role of entropy in ensuring the diversity of {V log log ( In Appendix I.3.2, further relax the linear softmax assumption and consider strongly log-cod cog-concave distributions. Finally, in Appendix F, introduce variant of GaussMark. and GaussMark. GauesMark.Generatee that is theoretically robust to random corruptions.
L1. Missing Details from Section 3
We start with giving illustrative example using Gaussian distributions explain why GaussMark works.
Illustrative Example. Suppose X' y Id and let (o æ) = -(0, Because under Ho, the watermarking key E (00 T2l is independent of v. it is easy see that (1y x) ~ (N for any fixed x, y. In particular,
28

---

GaussMark: Structural Watermarking of Language Models
Task
Phi (LowRank)
Phi (Unwatermarked)
BoolQ
0.8502 # 0,0062
0.8532 # 0.0062
CB
0.0893 = 0.0385
0.0893 = 0.0385
COPA
0.8700 = 0.0338
0,8700 = 0.0338
MultiRC
0.3195 = 0.0067
0.3296 0.0068
ReCoRD
0.8705 = 0.0033
0.8725 0.0033
RTE
0.7545 0.0259
0.7509 0.0260
WiC
0.5549 0.0197
0.5752 = 0.0196
Winograd
0.7981 0.0396
0.8269 = 0.0373
Table 11. Performance GaussMark on SuperGLUUEPhi..5-Min LowRank).
GaussMark (Rank Reduced)
Model
KGW-1
KGW-2
GaussMark
Llama3.1-88
.47
.42
.45
.47
Mistral-7B
.47
.43
.50
.50
Phi3.5-Mini
.48
.44
.49
.47
Table 12. Comparison of win-rate in AlpacaEval-2.0 between KGW and GaussMark. Higher is better.
BH.LV(,,E1 x)] 0. On the other hand, under HA, y pa-e 1.1 x)) NNO0 E, and Lemma I.1 implies that
Vd
EHA (
VI+
for a 2 1/a. Applying standard concentration of Gaussian random variables yields bounds on the power of the test, with higher dimensions leading to an improved test.
Lemma 1.1. Let E ~ (0, and pa x) ~ N(O,Ia). Then, with probability at least 1 5,
o²
v(v.El=)2
Vd
VI+02
as long as ozdz (log(1/)). In particular, of 2 / Ilg (min(a,))) then ab yields a test with level a and power 1 - B.
Proof. Note that v log (x) 0. Letting z NN Il),, we see that under HA, we may take = + Thus,
Vog x)) || (5.2).
By classical Gaussian concentration (e.g. Vershynin (2018, Theorem 3.1.1)), it holds that with probability at least 1
1 2 o²d ooo2dlog(10))
and
[ Vo'd C CVlog(1/5).
Noting that (5 is distributed centred one-dimensional Gaussian with variance ||El] see that
(E, v Po x)) o'd -- log(1/8),
where we allow the universal constant C' to change from line to line. On the other hand, it holds by the same concentration inequality that with probability at least 1 8. 8,
I + 2|| |El|| + |2|
Combining these events and taking a union bound, we see that with probability at least
(vvEE1)) ddd log(1//1lg///)) log(1/0)
o²
Vd- 0² (1/6)
Vd-oV
(+(1=)))loog(//))
VI+02
o²
29

---

GaussMark: Structural Watermarking of Language Models
Model
GaussMark
KGW-1
KGW-2
Llama3.1-8B
0.7983
0.7221
0.8519
Mistral-7B
0.7284
0.7034
0.8618
Phi3.5-Mini 0.7198
0.7349
0.8587
Table 13. Comparison of AUC after roundtrip translation through French for GaussMark, KGW-1, and KGW-2 on various models. Higher numbers are better.
Note that if ad & / (1/)) the first term dominates the second concludes the proof of the first statement.
For the second statement, note that under the null hypothesis, by Proposition 3.1, vp is normally distributed and thus we may set & Vlog(1/a). The result follows.
Next, we outline the proof Proposition I.2, which characterizes the hypothesis in Ho that is nearest HA-
Proposition I.2. Let (pe hereaa be a family of measures on y, x E X, 9 E Rd, and v E A A(R)) be fixed. Suppose Ho = (v u (V))) is composite and HA is simple, such that & ~ u and y ~ po+e. Then the projection of HA onto Ho in KL divergence given by Eg-ooloose (-1 x)). i.e.
inf DKL (HA |1 DEL (po+e(- x) Egge x=)) Ho
Proof of Proposition 1.2. Let x X be fixed. Further, let A(Rd) and μ A()) be arbitrary. For any g Rd we have
DKL (po+e(-1 (1) DEL (po+e() x:) Egr [po-sr x)
GeinllPore x)]
Ey--oie log
m())
P9-5 x)) log
E Eeg- (pe (y a:)]
EEeee
Eei- [pote (y/ [r]]
m(y)
Taking the expectation with respect to and noting that for both e Ho and HA if 1 @ and p" v @ Ee-r(po-s-(C (-1 1: then
DKL. (HA (|p) - DRr. (HAllp") Eg-v [DRI. (pote(: x))l()))) - DRI.. (porel: (: (x)) [err D)] p [ x))
log Ege- (y) x)]
-Eg-v Epone Eg [po+g] (3) x)]
M(v)
-KL (Egie( (1))]]11)) 0,
where the first equality follows from the chain rule.
We next provide the series of approximations leading to (3).
Proof Sketch for (3) Note that using the first-order Taylor's approximation for log pore x) around log x)) in have
Po+s x)) Po x))
logpe+<(() x)) log (pe-s [x]] = log ( ( x) - log x) log E
(E. Vo log x)) - log Eg-ee ((E', Vo log po( x)))]
(c. Pog x)) o² Vo Vologpo(1 x)1
2
Vo log x))
where the third line uses the MGF for Gaussian random variables, and the approximation in the last line holds as a
30

---

GaussMark: Structural Watermarking of Language Models
1.2. Level of GaussMark
In this section, we provide the proof of Proposition 3.1 that demonstrates that GaussMark produces statistically valid p-values and qualifies exact test, with almost underlying assumptions.
Proof of Proposition 3.1. Recall that under the null hypothesis Ho. for any æ X, the key and the generated text y are independent of each other, i... (5,g) ~ -N(0, d²In) q for some q é A()). Thus, the level of the test
РTн, (1.555 2) = 1) = Be-N(O,, sng I (c. v log ( x))
all (o x)1 > Ta
(S, V Pog (x)
Byy Pre
Ta
V logpo (y x)
Bynq ( (v. x) 2 To)
((T))) aa
(O, 1) for any vector logps(y x). The last equality simply plugs in Ta p- a), concluding the proof of the first statement. For the second statement, because & z) ~ (0, 1), it is immediate that (VV( x)) Uniform([O, 1]), and thus 1 - ( x)) is valid p-value.
where in the last line, we used the fact that cy < .²) (o.Voogeo ol (y
I.3. Power of GaussMark
We first note the following supporting technical lemma bounding the expected value of Gaussian density under a halfspace constraint.
Lemma 1.3. Lei a, 7 I with 7 2 0, and u e IR Let Z ~ L.) Then,
[[I[(2, [) S sale 3122 =(1 (1+7) 4/2.
vI+
Proof. Note that
E 1[(2, w) s saee sa)=-31211 31211] = (2m) -d/2 fr
e 11=11 dz
(2: (2.u)sa)
= =(++))- 4/2 f
-4/2
2T
4/2
e 2(10)111 |2|2 dz
1= (z,0)sa)
1 1+7/
= =1++)) 4/2 PP
2 1 + 7 sa)
=11+7) -d/3 P (Z. s sav/+t))
= =(1+7)-d1 d/2 +
|u||
where the equality in the third line above by noticing that the term inside the integral corresponds to the density function of The last line follows by observing that (Z, u) ~O lu|²) for Z ~ ~O,
1.3.1. LINEAR SOFTMAX DISTRIBUTIONS
Throughout this subsection, we use the notation [+] to denote (x)
Compatibility of softmax model with generation process of language models In particular, for any sequence of tokens y = UL. if the conditional probability (e x vet) is linear softmax model for each t S T', then the overall model
(0 ((clnone)))
Po x) = I (o xove))
I
= f=l Evey (((ooo()))))naa)
31

---

GaussMark: Structural Watermarking of Language Models
e (((()(ron)))
Egey E. (r(((loae()))
is also linear softmax model. However, note that throughout the paper, focus softmax modeling the level of the sequence y.
Lemma I.4. Let po 2)) denote linear softmax policy dimension (Definition 3.2) w.r.t. feature mapping sp Then,
20-<(V) a.) Pa (y x)
els.v po (v|z))
E (olte:)oopo(ole))
Proof. Fix any x e X, and define the normalizing constant
Z(0 x)) == Σ (l
DEy
Thus, log(po(y z)) (0. (pyl x)) - log Z(0) z). few simple calculations show that for any y e y,
v Vlogpo x)) = ( x) - Eoo (v(( [x)]
(5)
This implies that
log pote
(b) x2)
log po
= 10------///l/11-1122000000000000 2)) +))+ log 2(0 x)
log =log 2) 2() log ((- x))
log 2(0 xz) log (() (: (E. logpo(y |z))
where the last line plugs in (5) for v log z). Next, note that
EvEy ((:r(())))))))) c(0.)(()))))
log Z(0 x)) log + = log
log (Eo (E:o(o)ke))
2(0
Combining the above two bounds, we get
pots (y|=) x) logpo(( xx) (E, Vlogps (yl x)) (E. (ol =)]) log (oo ((EE)((b))))
(E, V Po (v) x)) (Bol (elp[eeeeeaaa ((ssett)))))Bl(((oo)))
(E. v log (y) x)) log (Ea ( (o0))))
where the last equality again uses (5). This concludes the proof.
We next prove Proposition 3.3, which establishes bounds on the power of our test in GaussMark. Detect under the linear softmax modeling assumption.
Proof of Proposition 3.3. Proposition 3.1 shows that vé yields test at level a. Note that the power of the test
Pтнa (v. (1 s Ta)=
Eg E
Ey-pers
[I $ ra]l]]
Po+s (v x) ((( Ta}
Eg
Ey-po
poly x))
( (vg
Eg
Eyy-po
(+((,(())) n.
Ey-po ((L.Vlogpa((le)))
where the last line plugs in the corresponding form for the density ratio pere(ol=)) obtained by simply utilizing the properties of linear-softmax distributions (Lemma 1.4 in the appendix).
32

---

GaussMark: Structural Watermarking of Language Models
As mentioned in the main body of the paper in the discussion proceeding Proposition 3.3, for the linear softmax model, entropy plays key role in ensuing diversity of the vectors v log po(y x) the unit sphere, when the feature set (p(y)) y is sufficiently rich. In the following, we provide intuition for this claim. Note that for any y, under the linear softmax modeling,
v Vo (x) = ( x:) Ry--s [ x)]
Thus, the spread of the set of vectors {Vlog Pog x)) pey is controlled by the spread of the vectors {4(y) 2)) yee. Recall that | & for some O. Consequently, V log po x) 2c. On the other hand, the lower bound on V logpo xx) is influenced by the entropy of pa-
If the set {s | ] is well-spread on the sphere and has large entropy, then we expect Ey-po [p(y]] x)] Ô. As a result, (E. V log (o x)) = (5, ((y x)) = II when {yp(y x)) covers the sphere. Furthermore, this implies that V log x || 2 c. These approximations, however, break down when the entropy is small -for instance if pe (- x)) is an atom on some y' yhethen v log (1/ (x) = O, and we do not have a lower bound on sup, V logpo(y |+)
The above discussion gives intuition for why we expect & | log ( =))l R when the underlying distribution po exhibits high entropy. Corollary I.5 quantifies the degree to which these idealized conditions hold and establishes bounds the test's power under certain mild assumptions. We now proceed with its proof.
Corollary L.S. Let a'E (0. 1), inpul prompt X, and suppose that all the conditions of Proposition 3.3 hold. For any & E IRd and 5 1), ler Ta(E 0,x)) denote the (1 - 8)th quantile of the random variable (E, v log x)), where ~ pa(- (-(1xx)) r). Suppose there exists ā E (0, such that
x(0, suu log
[exp(o a po x)) - -f (6,1,)))]]
(6)
is non-negative. Then, for any 3 E (0, 1), the test in Algorithm 2 has power 1- for
log
^(0,x))
Proof of Corollary L.5. Starting from the result of Proposition 3.3, note that under softmax parameterization, the power of the test, denoted by B. is given by
Eo (el..Vlog T[(, v log (x) s loggoo/lloooollllllo ( [
B (1,
We can upper bound the numerator as:
B.f eellell.ooooleeee logpo(ul=)) T[(E, v logpo(y) x)) sora VoTalVlogpo(r x)]]]] s R. 10
Next, for the denominator, note that
Eo(cls (oke)))) Eo [o (ooooooooo()))))) I[(E, log x3) ia(E 0,)]]]
d'a(t10..). Pr((s, v log x)) (x(5 0,x))
Ta(el0,m)) a.
where the first inequality simply ignores the events where the indicator is O. The second inequality follows by using the condition inside the indicator in the exponent. Finally, the last inequality simply uses the fact that Fa(g 0,ar) is the (1 - th quantile of the random variable (E. v log x)), and thus
Pr v (y [z)) > Tz(E 0.x)) ã.
Using the above bounds (7), we get that
1
Prh (v(v.El | a) (
Eg Eo
33

---

GaussMark: Structural Watermarking of Language Models
A(0,0)
where the last line uses (6).
We conclude the proof by observing that the term on the right-hand side above is smaller than /3 when o 2 A(0.x)
log
6B
The following lemma demonstrates that the final probability distribution over the token space V can be expressed non-linear softmax distribution, where represents the weights of any feedforward layer in the model architecture. This result provides justification for the discussion following 3.2 and clarifies why, when |&| is small, a linear softmax model serves as good approximation.
Lemma I.6. Let be a token space, and suppose 0 denote the parameters in a feedforward layer of a language model be watermarked. Then, po x) exp(x(0,xx) (,(())))))))))))))) ) for some fixed feature maps X and ip
Proof. Consider an input prompt I: and suppose watermark the parameters 0 feedforward layer with index & that uses the ReLU activation function. Suppose the input to this layer is given by (z) where the non-convex function Jin hides all which are hidden since they are unaffected by the watermarking procedure. Thus, the
the parameters from layers 1, ,, l- 1 output of the éth layer is given by ReL gin (x)). The future laters (including feedforward and attention layers) would simply process this further into the logits Ian MäinRoll (RcLU((* gin (z))), where the function Jän is non-convex and hides all the parameters in the layers é+ 1......4.. that are again hidden since the watermarking procedure does not affect them. Finally, the output token is generated by sampling from softmax distribution given by po .>) oc exp(gan (ReL.(())) (RpIIn gin (x))) (p))) for V, where &o denotes the one-hot feature vectors corresponding token v. Defining x0,,z) 9tin (ReLU(0' gin (x)))
concludes the proof. A similar proof can be given for other non- ooneiinasssses such GELU, Swish, SwiGLU.
1.3.2. STRONGLY DOG-CCNAAVE DISTRIBUTIONS
While the linear softmax model is useful for modeling the effect of noise added to feedforward layer in single transformer block in our experiments, can also bound the power of our method under significantly more general assumptions. In the following, we provide bound on the power of the test when the distribution pe is strongly log-concave:
Definition 1.7 (Strong log-concate concavity). For any x X' and y e y, the map + log (3/ ) is n-sstrongly log-concave if for any E Rd.
Log s log œ) + (E, v log x)) 7 - 111
Various probability distributions satisfy the strong log-concavity assumption above. For example, the d'dimensional multivariate Gaussian P8 = (0, ( Σ) is strongly log-concave with 7 Amin [)) Furthermore, the linear softmax model with feature map o (locally) n-strongly concave with 1) Amin (Covy-ro [+(( x))) The following theorem lower bounds the power of our test when py is strongly log-concave. Again, for ease of notation, we will use Eg[=] to denote Ey-rs((>>[-].
Theorem L8. Let a. 3 (0, and Ta t - (1) where o is the CDF of the standard normal random variable, and suppose for all E X and y V, po(y] x) is n-strongly concave w.r.t. 0. Then, for any x E X, the test (g.Vlog > Ta utilized in Algorithum 2, has power 1 whenever
2 log (og(Ro[ee [e (olpoooooll) + 2log
d d2
log(1 [ 2)
In particular, let the function A: 0 X R de defined such that
A(0, x) = sup 1 ア logoo// I))),
2
then the power of the level test is at least 1 - 3, whenever
BoTaA(0,2) log +
d 2
log(1 noo2)
34

---

GaussMark: Structural Watermarking of Language Models
The key idea in the proof of Theorem 1.8 is to use strong log-concavity once we have changed the measure y ~ Pe followed by Lemma 1.3 that measures the expected value of gaussian density function, under halfspace constraints.
Proof of Theorem I.8. Due Proposition 3.1, it clear that y yields test level a. In the following, we compute the power of the test. Let e X' be fixed. Under the alternate hypothesis HA we have that & ~ ~~(00, ofI,) and y pe+e(: a).
The power of the test is given by:
PTha (v(v, 11 0)
PLH, ((S, V log x)) s Tao (V logpo(y ==)l))
=EG-N(0,.PI.)) Ey-pore
(E, v (og x)) Taoll logpe +)
Po+e x)) poly x)
= =BC-N(0.0LL.)
Ey-ro
I[(S, v Vlogpo x)) s ToollV logpo(y x)
where in the last line, we changed the measure from po+e to po by paying for the density ratio pole (vll) Using the 7-strong concavity of log pa (y r), for every we have:
D x) ( x)
log
s (E, v log (x)) 7 IEl?
which implies that
PTнa (+(U,E11)=0)
$ S (R Ey-po ( (ocVloopo((l=)))3313 [[(S, v (og xx) TTollV x)]] [[( v log (y| x)) s o logro(y) I)]] E -1() BE (E-
$ pop Tn Vo log (vl=))
where the second inequality follows by utilizing the constraints inside the indicator in the exponent, and by using the fact that is independent of &. Using the bound in Lemma I.3 for the expected value of Gaussian density function under the halfspace constraint, we get that for any y.
(E- I[KE. lo x)) s T. Vogppoyy l)
- =1el s (1 +1+no?)- (02)-d12.000 T((T. V 11+
which implies that
PTμa (+),El1)) =0)
0) s (1 700))a122 Φ Ta v + no?
Eol Foo 1 [1
s (1 + n 1/ e taoll log (x))))
where the last inequality follows since (-)) s 1. The above bound implies that
"HHAE x) = 0) s 3,
whenever
2 log [oo TofeTaollVoospoollll + 2log(3 }3)
d 2
(1 + 2
I.4. Robustness to Corruptions of the Candidate Text
We have thus far demonstrated that GaussMark.Detede (Algorithm 2) enjoys high power under some mild assumptions (cf. Proposition 3.3 and L88,, but in practice, an adversarial user may modify the generated text to avoid detection of the watermark; for example, the user may first generate text y from the watermarked model, and then modify it to 7. by inserting, deleting or substituting tokens, or even by paraphrasing y. Thus, a practical watermarking scheme must be at least somewhat robust to corruption of the generated test. Indeed, as we show in the following theorem, a slight variant
35

---

GaussMark: Structural Watermarking of Language Models
of GaussMark. Generate and GaussMark. Detect, given in Algorithm 3 and Algorithm 4 respectively, enjoys theoretical robustness guarantees against constant fraction of corruptions under the mild assumption that a token-level test the uncorrupted tokens has sufficiently small level and high power. While we do not empirically investigate this alternative variant, we do observe that the original GaussMark enjoys some degree of robustness against corruptions in our experiments (cf. Appendix F).
Formally, we devise a robust detection test that takes in an input prompt æ', a watermarking key ç' (E,...., Sk) e RR and candidate text y' (v/,.... . 2'x)) y** consisting of K tokens, and tests the following null and alternative hypothesis:
Ho: Given z, the key and the sample are independent, i.e. (5', ./) ~ N (O, Ik) @ og with q A(V).
HA: The sample y' is produced by Algorithm 3, using the key g and input prompt x'.
Additionally, in Algorithm 4, the notation Quantile IT.,..., ['x)) is used to denote the maximal (in a sorted list) element
I' E {T(()) Jask that satisfies the relation R Ex [T s sT') s X, where X' is the quantile parameter. Then, the following result holds.
Proposition 19 (Robustness). Let co, B0 10 and K denote the length of the candidate text. Suppose that for every ke é [K], input prompt x' e X, the prefix of tokens d'2x Vx((-1), watermarking key &x. E IRd, and the candidate next token Uk the token-level test given by I (5x.V log poluf a'ov(a))
2 Tao has level an and power 1 -u in distinguishing between the
a|V log (v, [xxx))]
following (token-level) null and alternative hypothesis:
H The key E and the token v'g are independent, i.e, (4) ~ -NO,, @ ph with μe A(V).
H The token v is generated in (round of) Algorithm using the input prompt x'. prefix of tokens d' and watermarking key E--
Then, for any B, do E (0, 1), input prompt x, candidate text y = (U1,-... UK)) and quantile parameter X, the test in
Algorithm 4 has:
level a, whenever X' 1/1--o 0g and K 2 2(-x--0)==
log(V=)
power 1-3, whenever X No + 9o and K (I- Bo) log (t)
while being robust under random independent substitutions affecting up to An-fraction of the tokens in y.
We observe that Proposition 1.9 requires the token-level test to have the respective guarantees its power and level for any prompt x' and prefix sequence V'ex- This aligns with the style of guarantees that provided for the vanilla test in GaussMark. Detect. In fact, the results of Proposition 3.1 and Proposition 3.3 already imply such guarantee by setting v/g and x x' o Uck- Furthermore, while Proposition 1.9 considers random substitutions of candidate text our analysis can be easily extended to robustness guarantees against random additions and deletions. The quantile-based test in Algorithm can also boost the power of our test; notice that 3 can be made arbitrarily smaller than 3g by appropriately setting K. However, since we find that Algorithm is already quite powerful in our experiments, we leave empirical validation of utilizing Algorithm 4 for future work.
Algorithm 3 GaussMark. Generate: Robustly generating watermarked text
1: Input: Language Model pe V + A(V) with parameters E O, prompt variance o² > 0, generation length K. iid N/O, 2T.)
2: Sample watermarking key = (fI,..., } where &
3: For k {I,..., K), generate next token via us ~ parce (: oc.).
4: Return y (U1,-..,
Proof of Proposition 1.9, For E [K]. define the random variable Zμ = I[T 2 -- - ap)}. where I& is defined in Algorithm 4.
36

---

GaussMark: Structural Watermarking of Language Models
Algorithm 4 GaussMark.Detect Robustly detecting watermarked text
1: Input: Language Model pa 12 ())) with parameters ε O prompt x, candidate text {UI,.... ). variance
o² > O, watermark key 5 = (fi...., [K ), robustness parameter λy (0, 1). token-level test's 's level on (0, 1), quantile
parameter X.
2: For k (,,..., Kj. evaluate the test statistic Fa
(E log pe (vellouuu
al log Po 2oo1
3: Define (g E x) == yuantiley I,.,,...,
4:
if (v. x) 2 Φ (1 ao) then
# 4 the CDF of standard Normal distribution
5: Reject Null and output "watermarked".
6:
else
7: Fail to reject Null
We first bound the level of the test in Algorithm 4. Let q E A()) be the distribution, independent of &, from which the sample y is drawn under the null hypothesis Hp. Since, the token-level test has level og for all & [K], have
E La L
Ze x vekkk S ap-
(8)
For the ease of notation, we EE,oo Zx. denote the expectation BG.- Zx x oou for k E [K]. The level of the sequence level test is given by:
(v. xx) x -- an)) Prh, (Quamtile, (T...... [x] x (1-a(1
PrHo
Σ
Zp K(1 ((1-)))
Ac[K]
Prh.
Σ ZB Ex,0l Zx] K(1-X) Σ
Ex,ol 35,,o[Z4) Zx]
bek
be
PTHo
2 21-X'-au Σ Z* Ex,o[Za] KeeK
where the equality in the second line follows from the definition of Quantile, and the inequality in the last line due to (8). Next, note that under the null hypothesis Ho. < ( {x} ~ (0, Ia) and y ~ q where g independent of E. Additionally, because the substitutions done randomly, and independently of y. the random variables (Zi..... Zk} independent (under the null hypothesis). Thus, using Hoeffding's inequality, we get
РTн, (v(V. 10'(1 aQ)) se 22(
whenever X' 1 ag.. The above implies that the test is at level a for K 2(1-X-o0)- log (1).
We next bound the power the test Algorithm 4. Let denote the set of those indices e [K] for which the block un not corrupted. Thus, [K] K(1 So). Since, the token-level test has power - 3o for any uncorrupted token, we have
(L) "p-P6iée ((zova))
[Z x Uet] 2 1 -8o.
for any K.. We note that
Pтнa (1 (1-ao)) -Pha (Quantile, (Ti,.... Tx] < < (1-aa)
=PHAA
Σ Zz K(1 X(1-)))
ke[
< PPнН
Σ Ze < K(1 ((1-(>))))
kek
37

---

GaussMark: Structural Watermarking of Language Models
where the second line follows by plugging in the definition of Quantile, and the inequality in the third line follows by ignoring the corrupted tokens. Next, for k [K], let [ denote the expectation (0, ve-p-- (izovce) ) [Z vek Adding and subtracting ER.A [x on both sides, we get
PTнa (V(VE 2) + 1 ao)) PTHA
Σ
EA,- K(1 X) Σ Bk.Al [ [
kel
AEk
PPHa
Σ Z A
<K -2- - 107(1 800)
[|C
KEE
S PTHA
Σ lee.
E
<-> + Ao + 80
[|C
where the second line follows from (9), and the third line uses the fact that ((1- s |C] K. Next, notice the fact that under HA. the tokens vi,..., are generated following the autoregressive process in Algorithm 3, and thus, the sequence, { [ forms a martingale difference sequence. Using Azuma-Hoefiding's inequality, we get
РгнĄ (v. x) (1- & -K1(('->00000)
whenever X 2 Ao Bo. The above implies that the test has power 1 3 whenever [K] 2 (2-220-80) log }) which happens
when, K (1-A))(1-2--8)) -)) log
38

---

GaussMark: Structural Watermarking of Language Models
1.0
1.0
Mistral
Llama
Phi
TPR@FPR=0.00
TPR@FPR=ONN
0.6
0.6
0.4
0.4
Mistral
0.2
Llama
0.2
Phi
0.0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Added Tokens
(a) Adding random tokens.
(b) Removing random tokens.
1.0
1.0
Mistral
Llama
Phi
Power of Test
0.6
0.6
0.4
0.4
Mistral
Llama
Phi
Random
0.0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.2
0.4
0.6
0.8
1.0
Fraction of Added Tokens
Size of Test
(c) Substituting random tokens.
(d) Roundtrip translation.
Figure 13.. Demonstration of robustness of GaussMark four kinds of corruptions. We demonstrate the effects of (a) random insertions of tokens, (b) random deletions of tokens, and (c) random substitutions of tokens on the rate detection of true positives of watermarked text averaged over 3 seeds. We also consider the effect that (d) roundtrip translation (through French) has the ROC curve and include the ROC curves of the watermarked model on uncorrupted data for reference. Note that GaussMark is relatively robust to token-level corruptions and retains nontrivial power after the more challenging roundtrip translation attack.
39

---

GaussMark: Structural Watermarking of Language Models
1.0
1.0
0.8
0.8
TPR@ T F
TPR@ FR@@FP==0000
0.6
Mistral
Llama
0.4
Phi
Mistral
0.2
0.2
Llama
Phi
0.0
0.0
0.1
0.2
0.3
0.5
0.1
0.2
0.3
0.5
Fraction of Added Tokens
Fraction of Removed Tokens
(a) Adding tokens to prompt.
(h) Removing tokens from prompt.
1.0
0.8
TPR@FPR=0.05
0.4
Mistral
0.2
Llama
Phi
0.1
0.2
0.5
Fraction of Added Tokens
(c) Substituting tokens in prompt.
Figure 14. Demonstration of robustness of GaussMark to ignorance of prompt. We demonstrate the effects of (a) inserting, (b) deleting. (c) substituting parts the prompt on the fraction of detected sequences the p= 0.05 level. that GaussMark robust to these corruptions, the p-values remain relatively stable across different prompt corruptions, demonstrating that knowing the prompt is not necessary for watermark detection.
40

---

GaussMark: Structural Watermarking of Language Models
0.5
0.5
Mistral
Mistral
Llama
Llama
0.4
0.4
Median p-value
Phi
Median p-value
Phi
0.3
0.3
0.2
0.2
0.1
0.1
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Added Tokens
(a) Adding random tokens.
(b) Adding tokens prompt.
0.5
0.5
Mistral
Mistral
Llama
Llama
0.4
0.4
Median p-value
Phi
Median p-value
Phi
0.3
0.1
0.1
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Removed Tokens
Fraction of Removed Tokens
(c) Removing random tokens.
(d) Removing tokens from prompt.
0.5
0.5
Mistral
Mistral
Llama
Llama
0.4
0.4
Median p-value
Phi
Median p-value
Phi
0.2
0.2
0.1
0.1
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Substituted Tokens
Fraction of Substituted Tokens
(e) Substituting random tokens.
(l) Substituting tokens prompt.
Figure 15. Effect of token-level corruptions the median p-values of GaussMark for each of the three models.

---

GaussMark: Structural Watermarking of Language Models
1.0
0.5
Mistral
Llama
0.4
Median p-value
Phi
0.8
0.3
AUC
0.7
0.2
Mistral
0.6
Llama
0.1
Phi
0.5
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Added Tokens
(a) Adding random tokens.
(b) Adding tokens prompt
1.0
1.0
Mistral
Llama
Phi
0.8
0.8
AUC
AUC
0.7
0.7
Mistral
Llama
Phi
0.5
0.5
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Removed Tokens
Fraction of Removed Tokens
(c) Removing random tokens.
(d) Removing tokens from prompt.
1.0
1.0
Mistral
Llama
0.9
0.9
Phi
0.8
0.8
AUC
AUC
0.7
0.7
Mistral
Llama
Phi
0.5
0.0
0.1
0.2
0.3
0.4
0.5
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Substituted Tokens
Fraction of Substituted Tokens
(e) Substituting random tokens.
(l) Substituting tokens prompt.
Figure 16. Effect of token-level corruptions the AUC of GaussMark for each of the three models.
42

---

GaussMark: Structural Watermarking of Language Models
1.0
Var
1e-05
3e-05
1e-04
3e-04
1e-03
0.8
Rank 1024
0.8506
0.8491
0.8499
0.8461
0.7968
PPR@PPR=0.M
0.6
Rank 512
0.8461
0.8514
0.8469
0.8052
0.7013
0.4
Rank 256
0.8552
0.8469 0.8431
0.7945 0.6808
Mistral
Rank 128
0.8491
0.8446 0.8453
0.7892 0.6899
Llama
Phi
Rank 64
0.8560
0.8431 0.8423
0.7794
0.6626
200
400
600
1000
Rank 0.8499 0.8469 0.8332
0.7695 0.6558
Number of Tokens
(a) Detection of Rank-reduced GaussMark.
(b) Phi3.5-Mini performance on GSM-8K (Layer 31, down_proj).
Figure 17. Demonstration of effect of of rank-reduced GaussMark. (a) The fraction of detected watermarked responses p= 0.05 for the rank-reduced version GaussMark averaged over seeds for each model. (h) effect rank-reduction on GaussMark. Generate measured by the performance of Phi3.5-Min preserved by MaussMark, with the z-axis being the variance of added noise. As more PCs are removed, Phi3.5-Ming can handle greater variance without corresponding reduction performance.
GSM-8K. Each curve reflects different number of the top principal components
1.0
0.200
Mistral
0.175
0.8
Llama
@ - 00.01
Median p-value
0.150
Phi
0.6
0.125
0.100
0.4
0.075
Mistral
0.050
Llama
0.025
Phi
0.000
0.0
200
400
600
800
1000
0
200
400
600
800
1000
Number of Tokens
Number of Tokens
(a) TPR p= 0.01 of Rank-reduced GaussMark.
(b) Median p-values of Rank-reduced GaussMark.
Figure 18. Detectability of rankereduced GaussMark on all three models measured by (a) TPR at FPR 0.01 and (b) median p-values as a function of number watermarked tokens. The watermark detectable for a substantial fraction of text all three models, with more tokens leading to increased detectability.
43

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1c-03
Var
1c-05
3c-05
Rank 1024
0.2091
0.0564
0.0023
0.0000
0.0000
Rank 1024
0.0008
0.0000
0.0000
0.0001
0.001 5
Rank 512
0.1814
0.0462
0.0009
0.0000
0.0000
Rank 512
0.0007
0.0000
0.0000
0.0002
0.0021
Rank 256
0.1
0.0386
0.0006
0.0000
0.0000
Rank 256
0.0007
0.0000
0.0000
0.0001
0.0014
Rank 128
0.1679
0.0399
0.0005
0.0000
0.0000
Rank 128
0.0009
0.0000
0.0000
0.0001
0.0014
Rank 64
0.1510
0.0369
0.0005
0.0000
0.0000
Rank 64
0.0009
0.0000 0.0000
0.0001
0.0016
Rank 0
0.1403
0.0292
0.0003
0.0000 0.0000
Rank 0
0.0008
0.0000
0.0000
0.0000
0.0010
(a) Median down_proj).
p-values
Llama3.1-8B
(Layer 28,
(b) Median p-values Mistral-7B (Layer 28, gate_proj).
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Rank 1024
0.5321
0.4436
0.2835
0.1184 1484
0.0072
Rank 512
0.4770
0.3798
0.2379
0.0792
0.0021
Rank 256
0.4789
0.3683
0.2353
0.0668
0.0015
Rank 128
0.4490
0.3918
0.2083
0.0591
0.0013
Rank 64
0.4590
0.3662
0.2243
0.0547
0.0008
Rank 0
0.4543
0.3561
0.2060
0.0567
0.0008
(c) Median p-values Sown_proj)
of
Phi3.5-Mini (Layer 28,
Figure Effect of rank reduction on median p-values GaussMark (a) Llama3.1-8B. (b) Mistral-7B, and (c) Phi3.5-Min As the rank of the quotient space increases, the detectability of the watermark decreases, expected.
44

---

GaussMark: Structural Watermarking of Language Models
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Rank 1024
0.5580
0.5019
0.4230
0.2449
0.0000
Rank 1024
0.4253
0.4056
0.3692
0.0303
0.0000
Rank 512
0.5375
0.4602
0.3867
0.1
0.0000
Rank 512
0.4185
0.4003
0.3412
0.0152
0.0000
Rank 256
0.5171
0.4473
0.3768
0.1
0.0000
Rank 256
0.4011
0.3867
0.2866
0.0023 0.0000
Rank 128
0.5171
0.4625
0.3844
0.1 0.1898
0.0000
Rank 128
0.3897
0.3609
0.2760
0.0023 0.0000
Rank
0.5277
0.4503
0.3836
0.1130
0.0000
Rank 0.3965
0.3723 0.2820 0.0015 0.0000
Rank 0
0.5269
0.4587
0.3707
0.1205
0.0000
Rank 0 0.3707
0.3306 0.2183 0.0000 0.0000
(a) GSM-8K performance of Llama3.1-80 (Layer 31,
(b) GSM-8K
performance of Mistral-7B (Layer 31,
down down_proj).
down _roj).
Var
1e-05
3e-05
1e-04
3e-04
1e-03
Rank 1024
0.8506
0.8491
0.8499
0.8461
0.7968
Rank 512
0.8461
0.8514
0.8469
0.8052
0.7013
Rank 256
0.8552
0.8469
0.8431
0.7945 0.6808
Rank 128
0.8491
0.8446
0.8453
0.7892
0.6899
Rank
0.8560
0.8431
0.8423
0.7794
0.6626
Rank 0
0.8499 0.8469 0.8332
0.7695 0.6558
(c) GSM-8K performance of Phi3.5-Mini (Layer 31,
down proj).
Figure 20. Effect of rank reduction in GaussMark model performance GSM-8K (a) Llama3.1-8B, (b) Mistral-7B, and (c) Phi3.5-Mini. As the rank of the quotient space increases, the model quality increases well, reflecting the decreased influence of the perturbation on the model outputs.
1.0
0.8
Power of Test
0.6
0.4
Llama
0.2
Phi
Random
0.0
0.0
0.2
0.4
0.6
0.8
1.0
Size of Test
(a) Effect of roundtrip translation through French on ROC
curves of rank-reduced GaussMark.
Figure 21. Effeet of roundtrip translation on rank-reduced instantiation of GaussMark.
45

---

GaussMark: Structural Watermarking of Language Models
1.0
1.0
Mistral
Llama
0.8
T T FFR=P.
Phi
T FPR=005
0.6
0.6
0.4
0.4
Mistral
0.2
0.2
Llama
Phi
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Added Tokens
(a) Adding random tokens.
(b) Adding tokens prompt
1.0
1.0
Mistral
Llama
Phi
TPR@FFR=0..0
TPR@FPR=0N
0.6
0.6
Mistral
Llama
0.4
0.4
Phi
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Removed Tokens
(c) Removing random tokens.
(d) Removing tokens from prompt.
1.0
1.0
Mistral
Llama
Phi
T @FP=0000
PPR@FPR=0.00
0.6
0.6
Mistral
Llama
0.4
0.4
Phi
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Added Tokens
(e) Susbtituting random tokens.
(I) Substituting tokens prompt.
Figure 22. Effect of token-level corruptions Rank-reduced GaussMark as measured by TPR FPR p 0.05.
46

---

GaussMark: Structural Watermarking of Language Models
0.5
0.5
Mistral
Mistral
Llama
Llama
0.4
0.4
Median p-value
Phi
Median p-value
Phi
0.3
0.3
0.2
0.2
0.1
0.1
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Added Tokens
(a) Adding random tokens.
(b) Adding tokens to prompt.
0.5
0.5
Mistral
Mistral
Llama
Llama
0.4
0.4
Median p-value
Phi
Median p-value
Phi
0.3
0.1
0.1
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Removed Tokens
Fraction of Removed Tokens
(c) Removing random tokens.
(d) Removing tokens from prompt.
0.5
0.5
Mistral
Mistral
Llama
Llama
0.4
0.4
Median p-value
Phi
Median p-value
Phi
0.2
0.2
0.1
0.1
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Substituted Tokens
Fraction of Substituted Tokens
(e) Substituting random tokens.
(I) Substituting tokens prompt.
Figure 23. Effect of token-level corruptions on rank-reduced GaussMark measured by median p-value.
47

---

GaussMark: Structural Watermarking of Language Models
1.0
1.0
0.9
0.8
0.8
AUC
AUC
0.7
0.7
Mistral
Mistral
0.6
Llama
0.6
Llama
Phi
Phi
0.5
0.5
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Added Tokens
(a) Adding random tokens.
(b) Adding tokens to prompt.
1.0
1.0
Mistral
Llama
Phi
0.8
0.8
AUC
AUC
0.7
0.7
Mistral
Llama
Phi
0.5
0.5
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Removed Tokens
Fraction of Removed Tokens
(c) Removing random tokens.
(d) Removing tokens from prompt.
1.0
1.0
Mistral
Llama
0.9
Phi
0.8
0.8
AUC
AUC
0.7
0.7
Mistral
Llama
Phi
0.5
0.0
0.1
0.2
0.3
0.4
0.5
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Substituted Tokens
Fraction of Substituted Tokens
(e) Substituting random tokens.
(l) Substituting tokens prompt.
Figure 24, Effect of token-level corruptions rank-reduced GaussMark measured by AUC.
48

---

GaussMark: Structural Watermarking of Language Models
1.0
0,200
GaussMark
GaussMark
0.175
KGW 1.0
KGW 1.0
0.8
KGW 2.0
Median p-value
0.150
KGW 2.0
0.125
0.6
AUC
0.100
0.075
0.4
0.050
0.2
0.025
0.000
0.0
0
200
400
600
800
1000
200
400
600
800
1000
Number of Tokens
Number of Tokens
(a) Median p-values for Llama3. 1-8B
(b) AUCs for Llama3.1
1.0
0.200
GaussMark
GaussMark
0.175
KGW 1.0
KGW 1.0
0.8
KGW 2.0
Median p-value
0.150
KGW 2.0
0.125
0.6
AUC
0.100
0.075
0.4
0.050
0.2
0.025
0.000
0.0
200
400
600
800
1000
200
400
600
800
1000
Number of Tokens
Number of Tokens
(c) Median p-values for Mistral-7B.
(d) AUCs for Mistral-7B.
1.0
0.200
MaussMark
0.175
KGW 1.0
0.8
Median p-value
0.150
KGW 2.0
0.125
0.6
AUC
0.100
0.075
0.050
GaussMark
0.2
KGW 1.0
0.025
KGW 2.0
0.000
200
400
600
800
1000
0.0
200
400
600
800
1000
Number of Tokens
Number of Tokens
Median p-values for Phi3.5-Mini.
AUCs for Phi3.5-Mini.
Figure 25. Comparison of detectability of GaussMark with KGW-1 and KGW-2 as measured by median detection times and AUCs for Llama3.1-88 (a-b), Mistral-7B (c-d), and Phi3.5-Mini (c-f).
49

---

GaussMark: Structural Watermarking of Language Models
1.0
1.0
0.8
0.8
TPR@FPR=O 00.05
TR@@PP==000
0.6
0.6
0.4
0.4
GaussMark
GaussMark
KGW 1.0
KGW 1.0
KGW 2.0
KGW 2.0
0.0
0.0
200
400
600
800
1000
200
400
600
800
1000
Number of Tokens
Number of Tokens
(a) TPR 0.05 for Llama3.1-88
(b) TPR at p 0.01 for Llama3.1-88
1.0
1.0
0.8
0.8
T FPR=0.05
T F
0.6
0.6
0.4
0.4
GaussMark
GaussMark
0.2
KGW 1.0
0.2
KGW 1.0
KGW 2.0
KGW 2.0
0.0
0.0
200
400
600
800
1000
200
400
600
800
1000
Number of Tokens
Number of Tokens
(c) TPR p 0.05 for Mistral-7B.
(d) TPR p 0.01 for Mistral-7B.
1.0
1.0
0.8
0.8
TPR@ FFR=0.RR000 00
FR@FPR=OR 00.01
0.6
0.6
0.4
GaussMark
GaussMark
0.2
KGW 1.0
0.2
KGW 1.0
KGW 2.0
KGW 2.0
0.0
200
400
600
800
1000
0.0
200
400
600
800
1000
Number of Tokens
Number of Tokens
(c) TPR == 0.05 for Phi3.5-Mini.
(f) TPR at p= 0.01 for Phi3.5-Mini.
Figure 26. Comparison of detectability of GaussMark with KGW-1 and KGW-2 as measured by the TPR @ FPR 0.05 and 0.01 for Llama3.1-88 (a-b), Mistral-7B (c-d), and Phi3.5-Mini (c-f).
50

---

GaussMark: Structural Watermarking of Language Models
0.14
16
Gaussmark
Gaussmark
14
KGW
0.12
KGW
12
0.10
10
Time (s)
0.08
Time
8
0.06
6-
0.04
2-
0.02
0
0.00
200
400
600
800
1000
200
400
600
800
1000
Number of Tokens
Number of Tokens
(a) Generation time (Llama3.1-8B)
(b) Detection time (Llama3.1-8B)
25
0.16
Gaussmark
Gaussmark
KGW
0.14
20
KGW
0.12
Time (s)
15
Time (s)
0.10
0.08
10
0.06
0.04
0.02
0.00
200
400
600
800
1000
200
400
600
800
1000
Number of Tokens
Number of Tokens
Generation time (Mistral-7B).
(d) Detection time (Mistral-7B).
0.14
16
Gaussmark
Gaussmark
14
KGW
0.12
KGW
12
0.10
Time (S)
10
Time (s)
0.08
8-
0.06
0.04
2
0.02
0
0.00
200
400
600
800
1000
200
400
800
1000
Number of Tokens
Number of Tokens
(c) Generation time (Phi3.5-Mini.
(f) Detection time
Figure Comparison between GaussMark and KGW generation detection times averaged across seeds and 100 generations for Llama3.1-8B (a-b), Mistral-7B (c-d), and Phi3.5-Mini (e-f).
51

---

GaussMark: Structural Watermarking of Language Models
1.0
0.8
0.8
TPR@FPR=D FPR=0.05
T TPR@@PR==0 =P.00.05
0.6
0.6
0.4
0.4
GaussMark
GaussMark
KGW-1
0.2
KGW-1
KGW-2
KGW-2
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Removed Tokens
(a) Adding random tokens (Llama3.1-2))
(b) Removing random tokens (Llama3.1-895
0.8
0.8
TPR@FPR==O ..05
PPR@FPR=O0 .005
0.6
0.6
0.4
GaussMark
GaussMark
0.2
KGW-1
0.2
KGW-1
KGW-2
KGW-2
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Removed Tokens
(c) Adding random tokens (Mistral-7B).
(d) Removing random tokens (Mistral-7B).
GaussMark
GaussMark
KGW-1
KGW-1
0.8
0.8
T FPR=0005
KGW-2
@ F.000.0
KGW-2
0.6
0.6
0.2
0.2
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Fraction of Added Tokens
Fraction of Removed Tokens
(e) Adding random tokens (Phi3.5-Min Mini).
(1) Removing random tokens (Phi3.5-Mini).
Figure Comparison between GaussMark KGW robustness to token level comuptions (adding removing at random points) as measured by detection at FPR 0.05 for Llama3.1 1amma.11-BB (a-b), Mistral-7B (c-d), and Phi3.5-Mini (e-f).
52

---

GaussMark: Structural Watermarking of Language Models
1.0
0.8
0.8
Power of Test
PPR@FPR=ONE
0.6
0.6
0.4
0.4
GaussMark
GaussMark
KGW-1
KGW-1
0.2
KGW-2
KGW-2
Random
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.2
0.4
0.6
0.8
1.0
Fraction of Substituted Tokens
Size of Test
(a) Substituting random tokens (Llama3.1-8B)
(b) ROC after roundtrip translation (Llama3.1-885
0.8
0.8
@PR@FPR==0 0.05
Power of Test
0.6
0.6
0.4
0.4
GaussMark
GaussMark
KGW-1
0.2
KGW-1
0.2
KGW-2
KGW-2
Random
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.2
0.4
0.6
0.8
1.0
Fraction of Substituted Tokens
Size of Test
(c) Substituting random tokens (Mistral-7B).
(d) ROC after roundtrip translation (Mistral-7B).
0.8
0.8
T FPR=0005
Power Test
0.6
GaussMark
0.6
KGW-1
KGW-2
GaussMark
KGW-1
0.2
0.2
KGW-2
Random
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.2
0.4
0.6
0.8
1.0
Fraction of Substituted Tokens
Size of Test
(e) Substituting random tokens (Phi3.5-Mini)
(1) ROC after roundtrip tramslation (Phi3.5 5-ini)..
Figure Comparison between GaussMark and KGW robustness token level corruptions (substituting tokens) roundtrip translation through French for Llama3.1 (a-b), Mistral-7B (c-d), and Phi3.5 (e-f).
53

---

GaussMark: Structural Watermarking of Language Models
J. Sample Generated Texts
In this section, we provide samples text completions via Mistral-7B, Llama3.1-8B and Phi3.5-Mini models. As above, the prompts are from the realnews ikk split of the C4 dataset. For the Phi3.5-Mini model, the prompts were provided along with the following instructions prior to each prompt:
< systemm >>
You are helpful assistant. < eedd
Juerr >>
Complete the following prompt: < <
lassistant|
In the examples below, the text under the heading "Base Model" represents random text completion sampled from the original (unperturbed) model. The text under the heading "Watermarked Model" shows a random text completion produced by the watermarked model, where the watermark parameters are as described in Table 2.
J.1. Example
Input Prompt:
Sci Sci-Fi fans will rejoice with today's news details about the upcoming game, Doctor Who: The Etern
Mistral-7B Generations
Base Model: ity Clock, have been released. The game is the first cross-platform adventure game in the series' history and was co-created by TimeGate Studios and gaming legends, Doctor Who writers Steven Moffat and Steven Thompson.
Doctor Who: The Eternity Clock will have multiple release dates as the game will release on Android, iOS, and PC the end of March with the release PSN coming a week later on April "The release date for the Xbox Live Arcade version is be confirmed," says TimeGate Studios. TimeGate Studios also released
trailer for the game, which you check out below.
Watermarked Model:
ity Clock have been announced by BBC Worldwide and Ubisoft.
On the way for the PlayStation 3 and Xbox 360 in March, 2012, the game allows players to experience an original adventure
universe created by Doctor Who: The Eternity Clock. The Doctor, River Song and other key figures make appearance in the game along with new roster of characters. On top of an epic adventure, the game features a variety of gameplay elements including third-person combat, puzzle-solving, and platforming. Check out a variety of images and trailer for the game below.
Llama3. Generations
Base Model: ity Clock have just been revealed. Both iOS and Android versions of the game are set to be released in Spring 2012. Also set to be released in 2012 is the much anticipated Movie The Dark Knight Rises and the new Dr. Who series. The official game synopsis, gameplay video, and screenshots follow. Wired, popular UK gadget site, has leaked some screenshots of the upcoming Android OS. According to the leaked screenshots Android 4.0 will feature an updated logo that looks borrow bit from HTC's Sense user interface. The update should come as surprise to many users Android 4.0 is expected to be released in November. Motorola has released new set of phones in hopes of reviving their lagging sales in the US. The new phones to their portfolio are the Milestone 3 and the Flipside. The Milestone 3 is the US version of the Milestone XT720 that was released earlier this year. The new phone will be running the latest version of Android, 2.2. It features a 3.7 inch touchscreen and runs on an 800Mhz processor. The phone available for $99 from Verizon. The second new Motorola phone is the Flipside which runs
54

---

GaussMark: Structural Watermarking of Language Models
on Android 2.1. features slide-out QWERTY keyboard, 5MP camera, and stereo Bluetooth. The Flipside available for $30 from AT&T.
Watermarked Model: als, have been revealed. Cryptic Games have collaborated with BBC Studios to bring life-like game based on the BBC's popular Doctor Who. Doctor Who: The Eternals is massively multiplayer online role-playing game based in the Doctor Who universe and is being developed by Cryptic Games, the makers of Neverwinter and Lord of the Rings Online. At the heart of the game are the Eternals, extra-dimensional beings that played a pivotal role in several key stories from Doctor Who. Among the Eternals are creatures known as the Oncoming Storm, whose mysterious plans for the universe have resulted in alien invasions and apocalyptic destruction. In Doctor Who: The Eternals, players will enter into proxy battle between the Oncoming Storm and the Eternals, who have recently come Earth. All races from Earth and the universe are involved, and gamers will be able to select one of these races to fight alongside. Players can join friends and allies in battling the Oncoming Storm to defend Earth from annihilation and restore the stability of the universe. This announcement is great news for the Doctor Who and Sci-Fi community. Doctor Who: The Eternals is set to be released in 2019. Keep to date with all the details this massive online game, here. Find the perfect gift for the Whovian in your life. Shop the Doctor Who range now.
Phi3.5 Miii Generations
Base Model: als. This action-packs pacoed title, released by Sid Meier Games, takes players on a thrilling journey through time and space alongside the beloved Time Lord, Doctor Who. Set in a visually stunning universe filled with futuristic technologies, cosmic threats, and unique alien races, the game promises to offer hours of engaging gameplay and a heart-pounding storyline.
The main character, players assume the role of Ewan, a new recruit who joins the iconic Time Lord's crew as they confront numerous interstellar villains. As an Eternal, Ewan can utilize various time-travel abilities and work alongside fellow companions to battle through challenges. The unique gameplay mechanics revolve around strategic time-travel combat, teamwork, and resource management. Players will have the opportunity to pilot advanced spaceships, command the TARDIS, and deploy time-portal gates to progress through the ever-evolving narrative. Doctor Who: The Eternals is an exclusive PS5 and PC release. Players can expect encounter thrilling game modes such Story Mode, where players navigate the overarching storyline with array of companions; Single-Player Mode, which allows players to tackle the game solo while engaging with rich lore and side quests; and Time Travel Puzzles, which puts players' logic and quick thinking to the test.
Developed by Sid Meier Games, known for their previous hits like Civilization VI and XCOM, Doctor Who: The Eternals is set to be a top-tier experience for fans of both strategy and science fiction. With its impressive graphics, dynamic storyline, and immersive gameplay, this game promises to captivate players for hours on end. Pre-orders for the game are available on both PlayStation Store and Steam, with release date scheduled for early next year.
Watermarked Model: ity Box, finally become available! Directed by showrunner Steven Moffat, who rose to fame with iconic Doctor Who screenplays, the video game will transport players into the whimsical and unpredictable universe of the beloved BBC series.
The Eternity Box, meta-spiritual accessory essential the TARDIS, serves as the pivotal centerpiece in Doctor Who: The Eternity Box, allowing players explore its universe and manipulate its hidden powers. The TARDIS, an ancient spaceship that explodes into stunning cosmic oak tree and transforms into the blue, British police box, has served as the conduit to countless adventures, and the game will similarly capitalize on its mystical presence. Steven Moffat's directorial expertise ensures that the narrative remains true to the characters and aesthetic of Doctor Who, delving deep into the universe's lore and witty humor. With the Doctor (David Tennant's performance) and the TARDIS constantly on the move, players will engage in a multi-layered adventure, combining elements of time travel, science fiction, and intergalactic drama.
As Moffat has consistently proven in both his writing and filmmaking career, Doctor Who: The Eternity Box aims clevate the character of the Doctor (voiced by Chris Addison) and the storyline of the game, setting it apart from other video games in the genre. With captivating character interactions, twisting plots, and immersive world-buil building, the Eternity Box pushes the boundaries of video gaming as we know it.
55

---

GaussMark: Structural Watermarking of Language Models
Whether you die-hard fan casual adventurer, Doctor Who: The Eternity Box promises to be a timeless classic for fans of sci-fi and fantasy. The collaboration between Chris Addison and Steven Moffat will undoubtedly deliver immersive gaming experience that pays homage to the essence of the beloved television series.
J.2. Example 2
Input Prompt:
Paris: Chris Froome is intent on defending his Tour de France title even if the owners of cycling's
Mistral-7B Generations
21-day endurance race refuse to give it the 2018 8 edition in his adopted home country of Britain. The 31-year-old British rider was talking Tuesday before the expected announcement from Tour organisers that the race will visit the Netherlands in 2018.
Base Model:
Chris Froome is hopeful that a decision on the 2018 Tour de France will include Britain as a stop. AP The Dutch leg part of move by the Tour focus on its most popular markets while cycling booming there. Froome's Sky team says "fully respects" the Tour organisation's commercial decisions. But Froome wants Britain involved again.
"If you see how cycling is going in Britain the moment, especially the roads, there are lot of people going the races on Sunday, there are lots of kids and people taking up the sport," Froome told The Associated Press. The Londoner defending his third Tour title and fourth overall in France. "It would be fantastic if we could get a Tour start in the UK." Froome said, "for a start, to give people in the UK a chance to see the biggest race the world, I think that'd The British Isles, without Ireland, last hosted the Tour in 1994, when the race went to Manchester and London. Froome prologue in Sheffield seal his first Tour title in 2013 and completed double British Tour win in 2014 with stage victory in Cambridge.
very good for our sport Britain."
The British time trial champion has three grand tour titles, including the Vuelta Espana in 2011.
Froome has also won four of the past five editions of the Tour de France's final time trial, including his first stage in the 2013 edition.
He will need to add that tally in this Tour France to stay ahead of his rivals the time trial on the penultimate stage.
After Saturday's epic mountain stage, the route from Pau Bagneres-de-Luchon features 34km stretch against the clock that is perfect for time trial specialists like Froome.
"It's definitely going to be interesting time trial," Froome said. "Obviously I've had a lot of success in the time trials, and that's really going to be where can make the difference."
Froome and closest rival Romain Bardet, who rides for French team AG2R La Mondiale, are 2:14 apart at the top of the general classification, with Fabio Aru a further 47 seconds behind. Updated Date: Jul 19, 2016 16:35 PM
Watermarked Model: 2017 Grand Tour calendar will likely bar him from racing in the sport's other biggest race.
Organisers the Giro d' Italia the first Grand Tour of the season in late May have decided to seek a new rule at the next International Cycling Union (UCI) congress in September that would ban cyclists who compete in races at the Olympics from the year's opening Grand Tour.
That would be direct shot the Tour and the one-week Olympics for the road race, for August 6-14.
World Champion Peter Sagan of Slovakia is among the riders who will likely benefit from the rule. "There are decisions to be made. If you want to ride the Tour de France and the Olympics you can't do both," said Mauro Vegni, director of RCS, the company behind the Giro.
Asked if the Giro could still be contested by the Tour winner - his words the "ideal" solution Vegni suggested that was no longer likely.
56

---

GaussMark: Structural Watermarking of Language Models
"I don't 't think so, because there are too many restrictions and in any case there are too many compromises, he said,
If a new rule passed, would likely prevent riders from taking part in the Tour before the Olympies.
A growing number of races the cycling calendar seen key preparation for the Tour, the sport's ''s biggest race. "I still think there are few months to try to find solution," said Vegni.
"I believe in positive approach. We can see what we can do."
Tour boss Christian Prudhomme dismissed the Giro proposal, saying the Tour-Giro debate had been resolved and that France was a "priority" for all the cyclists.
He said Froome and the five-time Tour champion Alberto Contador could be invited to the 2016 Tour to defend their respective titles.
Froome's s Sky team is also backing the Briton to defend his Tour title.
"It is always privilege to be champion and it would be wonderful if we could do it for another year," Froome told reporters on Wednesday in Paris.
"This will be my first decision, to defend my title," " said Froome, who added that he had received a letter from Giro bosses asking him he intended to ride the race next year. The four-time Tour runner-up Richie Porte has also received an invitation for the 2016 race.
"Chris on my list for the 2016 Giro," Vegni told AFP. "The Giro would be second chance to ride the Tour in 2017," he said.
Llama3.1 1-8B Generations
100th edition want to deny him his chance. Team Sky's ' Froome took the red jersey in Monday's Stage I team time trial in Dusseldorf and the defending champion said on Wednesday he was intent on winning for a fourth straight year despite the first concerns about race security after terrorism in and around the French capital. "They will do everything to make sure don't 't have a chance to the winner of the 2016 Tour," said Froome, who took the red jersey after he won the 2015 race. The leader of the Tour of Britain, Sky's Wout Poels, spoke more forcefully in radio interview with France Info. "Hopefully there will not be any incidents in Paris, but the Tour is much more than that. It is more about the safety and the well-being of all the people who have come here. They don't It want to do something to cause problems for the fans who have come to support the Tour. "It's possible to keep the parcours, but the Tour could have been very different. I don't know what they are going to do and it is difficult to predict." The Tour is planning to go ahead with plans for a ceremonial finish on the Champs-Elyses in Paris on July 24. However, the finish was subject to a vote on Tuesday of the assembly of the region surrounding the capital, the Ile-de-France. The finish was ratified by vote of 104-47.
Base Model:
21 top teams don't 't think he should. The current Tour route favors climbers, a rider like Froome who rides for Team Sky. The peloton's riders' unions voted on Tuesday to remove him from the Tour roster because he is "abusing the current UCI rules" and "unfairly" dominating the race. Froome has already won four Tour titles, plus another Tour de France in the form of the Olympics, and and his team say there's no question him standing down, Sky general manager is adamant that his 32-year-old rider will be riding in the Tour. "The world's best cyclist, in my opinion, is the defending champion Chris Froome, so I hope he'll be riding," he told AP. " "And it won't be just me who thinks that. All of his teammates will want him to be riding, and a lot of other riders in the peloton will want him to be riding. "So we're all hoping that he will be allowed to ride." Oriol Jazainc (Caterham), Rui Costa (Lampre), Joaquim Rodriguez (Katusha), Romain Rmadas (Lotto), Wouter Wentslauters (Lotto) and Ivan Vitsinov (Omette).
Watermarked Model:
Phi3.5-Mini Generations
100-year-old world championship push back against his demands. Froome, a former British cyclist, was in the middle of an unprecedented appeal against a UCI ruling last week. The British rider sought overturn suspension handed down him after his urine sample tested positive for banned substance, meldonium. Froome's 's main argument revolved around his years of competition before the drug ban, which was introduced by the Union Cycliste Internationale (UCI) only last year, should not retroactively affect his past performances. The UCI, however, maintained its stance on fair play and sought to uphold the integrity of the
Base Model:
banned. He claimed that the
57

---

GaussMark: Structural Watermarking of Language Models
Tour de France, one of the most prestigious events in professional cycling. The dispute led public outery among fans, commentators, and the cycling community, with discussions ranging from the ethics of retroactive bans to the role of personal conduct and performance in sports. Major sports brands and cycling events faced criticism, leading to reevaluation of endorsements and partnerships to ensure they are not supporting racism or injustice in any form.
In a move to uphold the integrity of the sport, the UCI announced on June 10th that it would not alter its initial decision. Despite this, Chris Froome's 's determination to make a comeback has been a major talking point. As he prepares for the 2018 Tour de France, the road ahead remains uncertain for both Froome and the sport.
Amidst the heightened tension and debate around fair play and substance abuse sports, Chris Froome's resilience and defiance exemplify the human spirit's perseverance in the face of adversity. While the outcome of his appeal remains uncertain, Froome's ' fight to prove himself continues to captivate the attention of the world.
Watermarked Model: 99.9 percent most famous bike decide not to let him ride, according to The Telegraph. In the context of the Tour de France, Chris Froome, British cyclist, has displayed determination defend his championship title, regardless of whether the renowned 'La Madone' (The Madonna) bike, owned by cycling's 99.9 percent most famous bike, "The Associated Press' or Agennce France-Presse' (the world's oldest news agency) chooses not to provide it for use in the race. The Telegraph has reported this sentiment from Froome, highlighting his unwavering commitment to the competition.
La Madone bike, often referred to as La Madeline, a cherished possession by the Tour de France organizers and holds immense value the race's s history and legacy. The bike was originally used in 1999 by Richard Virenque to win his third Tour stage and subsequently modified and incorporated into the organization a symbol of the event's enduring traditions. This custom-built bike is considered essential part of the Tour's identity, by cyclists throughout the race.
Chris Froome, prominent figure in the sport and three-time Tour de France winner, understands the significance of this tradition and the emotional attachment attached to La Madone. Despite potential complications arising from not having access to the coveted bike, Froome remains focused on his goal of reclaiming the Tour de France title. His dedication reflects the spirit and drive of professional athletes who often face challenges and setbacks but continue pursue their goals with relentless determination.
The decision not to let Froome ride La Madone may stem from various factors, such financial concern,, legal disputes, attempts uphold the race's regulations. Still, it does not appear to deter Froome from his objective. His strong determination can be seen as a testament to the cycling community" 's enduring passion, which goes beyond personal setbacks and challenges.
Ultimately, Chris Froome's 's commitment to defending his title, even in the face such circumstances, serves as an inspiration to athletes and fans alike. The Tour de France, one the most prestigious and historic events in cycling, continues captivate people's hearts worldwide, showcasing the extraordinary feats and the undying spirit of sportsmanship that is shared among the participants.
J.3. Example 3
Input Prompt:
Karl Kispert, principal of cyber and information security, has more than 28 years of experience in
Mistral-7B Generations
Base Model: AP/GRC Security Consulting, Implementation and Support, Data Privacy and Cybersecurity Risk Management. His prior positions include running sAP and GRC consulting practices as well as data privacy and cybersecurity risk management advisory and managed services practices, with strong focus government contracting.
His experience includes supporting a variety of public and private sector clients, including many in highly regulated
58

---

GaussMark: Structural Watermarking of Language Models
industries, in protecting their business interests and competitive position by securing and protecting data and networks. Mr. Kispert's focus is helping companies in wide variety of areas, including:
sAP Security Best Practices SAP Access Controls sAP Security Testing Data Privacy Protection Cybersecurity
Risk Management Information Security Management Information Governance Cybersecurity Risk Management
Data Breach Prevention, Remediation and Management Cyber Threat Analysis and Detection Information System Vulnerability and Risk Assessments Cyber Security Risk Management Data Privacy Consulting Mr. Kispert holds a Masters of Science in Information Technology and is an ISO 27001 Lead Implementer, CISSP, CISA, CRISC, SAP CRM, SAP PI/PO and SAP GRC Certified Consultant, among other security and risk certifications.
Watermarked Model: izing, designing, and implementing security solutions for both physical and cyber domains, to include security engineering, command and control systems, telemetry, HVAC, lighting, fire suppression, access control, video surveillance, network, and wireless technologies. Karl has been active in the cyber and information security industry since 2004 and has extensive experience developing and delivering cyber and information security solutions for military and civil defense missions across a broad range of facilities including embassies, barracks, air and sea ports of entry, forwards operating bases, and mobile operating bases. He has provided cyber security engineering services to include independent verification and validation of security engineering documents, performed technical risk assessments, developed detailed design documents, conducted cyber attack exercises, and defined and implemented security policies and procedures to address federal information security and privacy regulations.
Llama3.1 1-BB Generations
Base Model: Reasons Why Americans Fail at Cybersecurity By Karl Kispert 5 min read on February 24, 2017 Karl Kispert, principal of cyber and information security, has more than years of experience in systems, security and compliance. He also certified information security manager (CISM) and certified information systems auditor (CISA). Cybersecurity. If there's 's one thing that I've learned over the years in working with corporations, small businesses, academia, military, federal govermment, state government and even the entertainment industry, it is that everyone loves to talk about the importance of cybersecurity, but no one wants to talk about how they go about doing it. Just like in the movie "The Wizard of Oz," the truth is that you won't ' find the answer in cyber security. 1. They Don't Know What They Don't 't Know Most people have a pretty strong grasp on the way that their organization works. They see the day-to-day operations and watch as departments work together to perform their respective tasks achieve the organization's 's overall mission and objectives. This makes it easy to explain how your department helps the overall process smoother, and how you help to achieve the overall mission and objectives. In short, you do this. 2. Failure to Define the Threat If we look at it in military terms, there is always human adversary who you are fighting against to protect our way of life. It's not as much as it was about keeping them out of our country, it's about ensuring that the person is not threat to our citizens or infrastructure. But if we don't 't know the threat, then we can't ' protect against it. While a threat is commonly defined as a viable opponent of an organization, also the potential danger posed by the person, event or circumstance that could affect your organization's 's operations. 3. The Human Element Is the Problem Most people will tell you that they care about cybersecurity. but they really don't care enough to take any preventative measures to protect themselves. According to the 2016 Bitglass report, "The Human Factor: The Hidden Threat Security," human error remains prominent source of data breaches, and nearly half of all businesses admit that human error has caused at least one data breach in the last 12 months. This information not only reflects on the organization's 's response to security measures, but also reflects on how employees view the seriousness of their personal responsibilities for cybersecurity. Failure to take a proactive stance against cyber security represents a dangerous attitude. It's not a matter if you will have a data breach; it's a matter of when. One problem with the "when" part is that, by the time you realize that you have a problem, it's usually too late. In one study, 72 percent organizations did not discover breach until more than six months later. In another study, breach a breach within seven to 30 days and 30 percent discovered a breach more than 30 days after an attack. It seems that the last of those three groups, 33 percent, had the worst security posture. Why are we waiting so long? It seems like the longer you wait, the longer you will wait. Cybersecurity should be about prevention and not reaction. 5. The CISO as a Bridge If you think that a breach will never happen to you, then you should probably just go out of
identified in more than 33 percent of organizations within 24 hours, while 37 percent discovered
59

---

GaussMark: Structural Watermarking of Language Models
business right now, But if you understand the threat, and you done everything you can to protect your assets, then what that you do now? In the classic film "The Wizard of Oz," " the wizard was just man behind the curtain. When the character Dorothy found him and realized he just man, she revealed that she had all of the answers in her pocketbook. In similar way, when you understand the threat and how to protect yourself from it, you realize that all the answers have been in your pocketbook the whole time. When it comes to cyber security, most of us think that there must be a secret door with secret password in order to find the answers to our problems. But what there isn't 't a secret door and there isn't 't a secret password? What the answers are in your pocketbook all along? What it was just a matter of unlocking the door and learning how use the password? cybersecurity advice cybersecurity lessons
Watermarked Model: ecure cloud and other mission-critical computing environments, providing technical direction, ensuring operational supportability, and driving the development of specialized products and security solutions for the U.S. Air Force, other Department of Defense (DoD) agencies and private sector customers. As a technical leader of a secure systems architecture and software development organization, Karl has developed technical and system solutions for several mission critical programs, both the U.S. and abroad, including the Naval Data Link in Stuttgart, Germany. Karl's technical expertise includes secure cyber operations (National Security Agency classified programs, including Command, Control, Communications, and Intelligence (C3I)), as well as tactical, enterprise and high performance computing. He has developed and delivered enterprise solutions for command and control systems and messaging systems; and technical architectures for large, high performance computing systems. His background includes Secure Cloud solutions, virtualization, agile development, process integration, and data analytics and cyber. Karl is the chief engineer and project lead for two National Security Agency classified projects involving development of a Command and Control System using Microsoft Azure and the Joint Target Library (JTL) comprised of two large systems: a Windows Server virtualization cluster that hosts a relational database and associated server processes and high-performance compute cluster that contains in-memory database and computational processes. In these roles, he leads the technical development for cyber solutions and security solutions, developing concepts, designing architectures, and implementing technical solutions for Cyber Security/Information Assurance, which entails the design and development of secure solutions in accordance with Department of Defense (DoD) and National Security Agency (NSA) policies and regulations. Other roles include development of technologies for secure mobile device solutions using AppCircus and other secure mobile solutions for DoD eustomers. He has a passion for process integration, bringing together stakeholders from government and industry to leverage knowledge promote high performance computing and secure mobile solutions for DoD.
Phin.5-Mini Generations
elling cybersecurity and technology solutions across all industries. Kispert's approach to problem- solving is data-driven and -orietee, ensuring that he crafts innovative and effective strategies to safeguard businesses from evolving threats. As strong advocate for continuous learning, he believes in staying abreast with the latest advancements in the field to deliver cutting-edge services. His expertise in navigating complex technologies makes him an invaluable asset to both clients and the industry.
Base Model:
Watermarked Model: ophisticated threat mitigation. With comprehensive background security systems design, he has worked with notable institutions like the Homeland Security Department, securing classified government data and protecting critical infrastructures. Prior to his role Secure IT Solutions, Kispert directed the Cyber Security Division at Global Tech Solutions, where he oversaw the development and implementation of their state-of-the-art network protection solutions, including intrusion detection systems and secure communication channels. Kispert earned a master's degree in computer science from George Washington University, which focused on advanced cryptography and network security. His deep understanding of both thcoretical and applied cybersecurity practices has allowed him to lead teams through the evolving landscape of cyber threats, ensuring robust and adaptive defenses.
60

---

GaussMark: Structural Watermarking of Language Models
J.4. Example 4
Input Prompt:
Quite frankly, thoughts and prayers can only go so far. They have limited ability to protect our fam
Mistral-7B Generations
iles, our homes, our jobs, and our lives. Words and thoughts will not stop the chaos that is happening our country. Although they can bring comfort to those whose hearts ache and ears are bleeding from the pain and injustice we are experiencing on an hourly basis.
Base Model:
That is why our goal as a nation must to more than just offer up words and prayers for those who are struggling, although this very important and loving way to make our presence known those who suffer. It is just the beginning of what needs to be done. We must also commit to following up prayers with actions.
This past weekend, one man rose to the occasion and made huge difference in his community. James Richardson, local "activist" in Minneapolis took matters into his own hands after an early morning shooting left several people injured, one man dead, and several children present. Mr. Richardson took it upon himself to stop the violence in his community, and it clear that he has the respect of the community.
On Saturday morning, while the city of Minneapolis was having a "Stop the Violence" rally, and George Floyd's murder was still the topic of conversation, there was another incident that took place just one block from the rally, This of the latest of the many shootings that have taken place in the Twin Cities, Minnesota area. Three people were injured, and one man James Richardson has set up his own camp in the middle of a violent neighborhood, but he was able to successfully navigate the dangerous situation that could have resulted in a violent conflict. He went to the scene, and he was able to de-escalate the situation. The Minncapolis Police Department arrived shortly after the incident occurred.
killed.
He was able to calmly and peacefully speak with the police officers and the community members in order to get everyone on the same page. He also provided medical attention to those who were injured. He used his position and arrested.
influence connect the community and law enforcement. As result of his involvement, the shooter This is a story of unity and teamwork between the community and the police. Mr. Richardson is man who is dedicated to the betterment of his community. His example should be lesson to others who are attempting to create change.
Although these protests are very important in the sense that they help bring awareness to injustice and police brutality, we cannot forget about the message that the protests are supposed to deliver. These protests are supposed to a catalyst for change, not just way to make our voices heard.
Let's try avoid violence at all costs, and try to put a stop to the violence before it happens. We are all part of the same team, and there is a way for to make the world better place together. Together, we can create the kind of world that we want to see.
Join The Insurgents newsletter to keep up with the latest on the Black Lives Matter protests and other political events.
We will keep you up to date and provide you with resources on how to get involved.
Watermarked Model: iliars, to combat crimes against them, and to seek justice for the dead. If we want true solution, a permanent solution, solution that works, then we need to demand more from the leaders in our society, We need to advocate for federal bills such as the Preventing Animal Cruelty and Torture Act (PACT) and the PROTECT Act.
First, we need to protect the animals we love. That means seeking out the most aggressive measures to protect our friends from theft, from violent crime, from abuse, and from senseless massacre. We need a variety of measures, because not every situation is the same. The owner of the dog run in Oakland should have had video cameras deter the robbery, but the victim in Chopper's story (read it here) needed laws preventing owning exotic animals from the very beginning.
Second, we need to make sure that the criminals get caught, get prosecuted, and get convicted. That means treating animal crime seriously and appropriately. We need to pass laws against the most brutal forms of animal crime, because not every form of animal abuse is handled the same. We need to do this at a federal level because it's too
61

---

GaussMark: Structural Watermarking of Language Models
easy for criminals use interstate commerce to sell dogs across state lines and prevent out of state animals from receiving the protection of the law they need and deserve. Luckily, have good news for you! Bills are currently under consideration that would do both of these things. Both would crack down animal crime and punish the criminals who commit it. We just have to get them passed, and we need your help to do it.
## The Preventing Animal Cruelty and Torture Act
Congress introduced the Preventing Animal Cruelty and Torture Act, or PACT Act, in early 2019. The bill would not make certain acts illegal, since those are already illegal under state law. Instead, the bill would crack down on the worst forms of animal cruelty. Specifically, would make illegal to crush, slit, impale, drown, burn, and otherwise torture animals. It would also extend the coverage of federal animal cruelty statutes to all animals, matter how small or invisible. Instead of requiring visual, the new statute would simply require "sustained non-transitory mental state." In short, the new statute would make animal cruelty federal offense for the worst forms of animal abuse. would make it so that a person who roasts pit bull alive or tortures a sick animal for fun would go to jail. PACT would be yet another statute to help us in our fight against abuse and neglect. This bill is long overdue and would bring us closer to the day when every person the United States who loves animals is protected by the law. Luckily, elected officials don't have worry about that. While they were busy insulting one another, they somehow managed pass both 2018 and 2019 farm bill, without taking moment do something for the animals we care about.
We can't i rely on our elected officials to do the right thing and protect our animals. Our only recourse is to take action ourselves, to hold our officials accountable, and to take back the country. As such, we have to get the PACT Act passed. We need to call our senators and representatives and tell them to support the PACT Act and to pass it the next session Congress. While we're it, we should also thank them for supporting this bill, which would go a long way towards putting an end animal abuse.
## The Preventing Realistic, Organized Threats through Exploiting Children (PROTECT) Act
Not only should we pass laws to protect our animals, but we should also pass laws stop their slaughter. While it might sound like we're asking for the impossible, it isn't. Federal law prohibits killing dogs and other animals in interstate commerce. That is, you can't I take a dog from Kentucky and drive her to Ohio to kill her. The Supreme Court has even ruled that this prohibition is constitutional, even when it comes to an incidental killing of animals that happens during the interstate transport of another good. While the ruling does not prohibit the incidental killing of animals, does prohibit the intentional killing of animals during interstate transport. But what does that have do with the interstate
1lama3.1-88 Generations
lies, neighbors and ourselves. It's tough, complicated issue that cuts across religious, ethnic and national lines and divides the masses. It takes stronger, more effective action than good intentions prayers truly stop terrorism. The power to address and prevent terrorism can only come from our representatives, both locally and federally, who must do more to protect and defend our nation.
Base Model:
Watermarked Model: iles, friends and our nation from the atrocities of war. The best thing that we American citizens do is put end to the 'just cause' of the To remove forces, place moratorium the war, and take stand as Americans and support a definite plan of action to stop the escalation. We must stop and ask ourselves. 'Do we support the war in the Middle East?' Do we support the dismemberment of country and the murder of countless innocent civilians? If not, let's act on it. The Westboro Baptist Church will be holding a protest in front your homes Redding on Memorial Day, May 28th, 2018, in the Oak Grove area. The Westboro Baptist Church the organization that recently filed lawsuit against the now deceased Clayton Nickens, veteran, claiming that a grieving mother could not honor her son's death and should remove his flag. This organization associated with racism, homophobia and hatred. They thrive the hurt and grief of others and travel around the country protesting at the funeral services of our soldiers and children of those who are murdered in mass shootings. Our veterans need to be protected by those who support their freedom and their right to a peaceful burial. In the spirit of Memorial Day, which is the remembrance of our fallen soldiers, let's 's gather in a way to support our veterans and their families. We suggest all military families, active service members, veterans and their supporters to come
62

---

GaussMark: Structural Watermarking of Language Models
numbers counter the protestors. With this, we want respectfully ask that you come out to a location be determined later and bring your flags and signs counter the protest. This is not just local issue but national issue that affects us all. I support an event called Peace Rally in Fair Lawn, N.J. 12 noon, May 27, 2018. Please help spread the word.
Phi3.5-Mini Generations
Base Model: ished people from the destructive and malevolent cireumstances they face every day. Yet we continue preach spiritual healing the first step ending their pain, as though we're attempting negotiate peace with foe.
"Empathy is understanding someone else's struggles without pitying them."
It's not about making assumptions or superficially sympathizing with their plight, nor about telling them to just believe harder. It's about recognizing that their adversities are deeply rooted in systemic failings that not even their spirit and faith can resolve. They need our support, resources, and tangible solutions to help alleviate the hardships they's re dealing with.
We can't it afford remain delusional comfort zone spiritual platitudes. Instead, we must address the urgent problems confronting vulnerable populations head-on, actively working towards systemic change that allows them to prosper, while not letting their struggles go unnoticed. It's high time truly prioritize the well-being of the most vulnerable among us, and let our actions reflect that prioritization.
Watermarked Model: ously endangered species, including the black rhino. This assertion might seem bit strong, but hear out. If we want take concrete actions.
the black rhino and other endangered species, need to go beyond words and
Thoughts and prayers, crucial as they may be for many people, don't directly translate to conservation actions. They don't fund anti- anti-pogching efforts, don't help enforce wildlife trafficking laws, don't 't build the necessary infrastructure to protect habitats, and certainly don't address the root causes of species endangerment, such as habitat loss and poaching.
Here's 's what we need:
** *Sroonger Legislation and Enforcement Poaching and illegal wildlife trade remain substantial threats the black rhino. Laws need to be enacted and enforced protect wildlife and punish those who engage in these activities.
2. Communitt Involvement and Education Communities living near the habitats of endangered species are crucial to conservation efforts. By involving these communities and educating them about the importance of biodiversity, we can cultivate local culture of conservation.
** **Habitat Restoration and Expansion** The loss of habitat is primary reason behind species endangerment. Restoration of these habitats and, where possible, expansion, are essential to provide safe environment for these species to thrive.
4. *uppport for Conservation Organizations**; Conservation organizations are at the forefront of protecting endangered species. By supporting these organizations financially, through donations or volunteering, we can contribute to their ongoing work.
**Promote Responsible *ourism**; Tourism can be double-edged sword. If managed well, it can generate revenue for conservation efforts while creating awareness among tourists about the importance of biodiversity and the threats faced by endangered species.
6. ** **Research and Monitoring Continued research and monitoring essential understanding the needs of endangered species and developing effective conservation strategies.
While we shouldn't t discount the power of thoughts and prayers, we must recognize that they are not enough. If we want to see a tangible impact on endangered species, we need to take a more active role in conservation.
63


Reviews:
[{"review_id": "qqAVAAPvbg", "reviewer": "Reviewer_xKDx", "summary": "The paper introduces GaussMark, a watermarking scheme that embeds a subtle signal into a language model by additively perturbing its weights with a small Gaussian noise. Instead of operating at the token level, GaussMark leverages the inherent structure of text by modifying a single MLP layer within the model. The method formulates watermark detection as a statistical hypothesis test, where a test statistic based on the inner product between the noise vector and the gradient of the log-likelihood is computed. The authors provide rigorous statistical guarantees (e.g., via Propositions 3.1 and 3.3) and validate the approach with extensive experiments on several modern language models using standard benchmarks (SuperGLUE, GSM–8K, and AlpacaEval–2.0). Their empirical evaluation shows that the scheme maintains high text quality and very low latency in both generation and detection.\n\n## update after rebuttal\n\nI have read the other reviews and the authors' responses. I think this paper meets the bar of ICML, so I recommend acceptance.", "questions": "", "limitations": "", "rating": 5, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their careful attention to our work.  One point on the theoretical claims that we wish to clarify is that the statistical validity of our test does not depend on the linear approximations being sound and so the test’s statistical significance holds under virtually no assumptions.  It is only the power of the test for which we require linear approximations (or local strong log-concavity, cf. the paragraph beginning in line 300) to justify theoretically.  Note that the bound on the power of the test is not necessary for practical deployment as long as the true positive rate of detection is relatively high at a fixed false positive rate (as we verify empirically).", "claims_and_evidence": "Claims:\n\n- GaussMark is practical and efficient, with essentially no impact on generation latency.\n- It provides formal statistical guarantees for detection, ensuring control over false positive rates.\n- The method is robust to common token- and sequence-level corruptions and does not degrade model quality.\n\nEvidence:\n- Theoretical results (e.g., Proposition 3.1 establishes the test’s validity and Proposition 3.3 provides bounds on detection power) back up the claims.\n- Experimental results demonstrate that watermarking does not harm downstream performance and that detection remains fast and reliable even under various corruptions.", "methods_and_evaluation_criteria": "Methodology:\n\n- The watermark is embedded by perturbing a chosen model weight with Gaussian noise. Detection uses a normalized statistic that is compared against a threshold derived from the Gaussian CDF.\n\n- This approach sidesteps the latency issues seen in token-level watermarking methods by integrating directly into the inference pipeline.\n\nEvaluation:\n\n- The evaluation is comprehensive, employing standard benchmarks (SuperGLUE, GSM–8K, AlpacaEval–2.0) and covering various aspects such as quality, speed, and robustness.\n\n- Experiments also include ablation studies (e.g., on the effects of hyperparameter choices and rank-reduction variants) to illustrate the trade-offs between watermark strength and model performance.", "theoretical_claims": "The theoretical claims appear sound within the stated assumptions. However, the dependence on linear approximations may limit applicability in regimes where non-linear effects are significant.", "experimental_designs_or_analyses": "- Experiments are conducted on multiple language models (e.g., Llama3.1–8B, Mistral–7B, Phi3.5–Mini) with clear comparisons between watermarked and unwatermarked variants.\n\n- The design includes measuring generation latency, detection latency, and performance on language understanding and reasoning benchmarks.", "relation_to_broader_scientific_literature": "This paper leverages established ideas from statistical hypothesis testing and recent empirical findings on weight perturbations and model merging.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "Strengths:\n\n- Simplicity & Efficiency: The method is conceptually straightforward and easily integrated into existing pipelines without slowing down generation.\n\n- Theoretical Rigor: Provides clear statistical guarantees and theoretical analyses that enhance credibility.\n\n- Practical Impact: The approach is designed with deployment in mind, including fast detection and minimal impact on model quality.", "other_comments_or_suggestions": "See listed above.", "questions_for_authors": "See listed above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "U02Mu7gpXz", "reviewer": "Reviewer_nqFw", "summary": "The paper proposes GaussMark, a structural watermarking method for LLMs that perturbs model weights with Gaussian noise during generation. The authors claim this approach addresses limitations of token-level watermarking by embedding watermarks directly into model parameters. Detection leverages hypothesis testing on gradients of perturbed weights, with some statistical arguments.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their careful attention to our work.  We wish to clarify a few points.\n\n## The linear approximation\n\nWe wish to emphasize that while the motivation and power bounds do rely on some simplifying assumptions, as we demonstrate in Proposition 3.1, *the statistical validity of the test holds under virtually no assumptions*, in particular not requiring the linear softmax approximation to hold.  The power bound is an important theoretical result to guide us in understanding the effect different problem parameters have on the efficacy of our test, but is not directly relevant to practice; indeed, we verify empirically that Gaussmark has relatively good power in detecting watermarked text.  The discussion following Proposition 3.3, wherein we take $\\sigma \\to \\infty$, is meant to serve as a guide for intuition and we give a finite bound on how large $\\sigma$ must be in Corollary I.5, to which we allude in line 298.  Furthermore, we believe that this intuition is reflected empirically e.g. in Figure 7, which reports p-values of detection for different choices of variance and watermarked parameter; in this figure, when the variance is high for early layers (where we expect the linear approximation to be weaker) we see a *decrease in power, manifesting through increased p-values when the variance increases*, suggesting that the lack of linear approximation is indeed reducing the power of the test.  In the revision we will include additional discussion in the main body clarifying this point.  \n\nWith respect to the motivation, note that the linear approximation allows us to find a computationally efficient test statistic that (if the approximation is sound) will perform approximately as well as the minimax optimal test, which is likely computationally inefficient.  We agree (and will clarify in the revision) that the quality of the linear approximation depends on the operator norm of the Hessian which implicitly grows with sequence length, but this motivation is intended as a non-rigorous motivation for a statistic we find works quite well empirically.\n\nTo summarize: in the event that the linear approximation does not hold, there is no effect on statistical validity and while there may be an effect on empirical power, we demonstrate conclusively that one may choose parameters that do not suffer from this too much.  \n\n## The importance of fast generation and detection\n\nRegarding the speed of generation of watermarked text, it is important to differentiate between theoretical and empirical latency.  We agree that the approach of Kuditipudi et al is theoretically fast with respect to generation, but they do not report generation times themselves.  One key advantage of Gaussmark (cf. lines 173-175, 2nd column) is that it can be immediately integrated into preexisting generation pipelines, like vLLM that allow for substantially faster generation than more naive approaches.  The approach of Kirchenbauer et al is at least as fast in terms of generation as that of Kuditipudi et al and, as we show in Figure 27, the former is orders of magnitude slower in generation empirically (cf. Line 1406).  Furthermore, as noted in Kuditipudi et al, detection time grows quadratically in text length and their reported detection times are significantly slower than ours with much shorter texts.\n\n## Semantic Watermarking\n\nWe are happy to include additional discussion of other semantic watermarking schemes.  The paper mentioned by the reviewers is certainly relevant, but note that their results do not in any way dominate ours.  Indeed, as an example, their approach (as summarized by Table 1 in that paper) leads to substantial declines in text quality, despite improving on pre-existing work, in contradistinction to GaussMark, which we demonstrate does not lead to reduced text quality on a wide variety of benchmarks.\n\n## Why the TPR saturates in Figure 2a\n\nThis is a good question.  Note that the answer is likely *not* because the linear approximation becomes invalid for long sequences, but rather because the power calculation predicts that our test is only consistent with high dimension, not with increasing sequence length.  Were the linear approximation breaking down the cause of this phenomenon, we would expect the power of the test to potentially decrease (as we discuss above in reference to Figure 7), which we do not observe.\n\nWe suspect that the power could be improved by adding noise to multiple parameters at once, as we suggest in Line 438, 2nd column; this is an interesting direction for future research.", "claims_and_evidence": "Authors claimed that new method GaussMark: is designed to fix multiple problems of token-level watermarking, like \"generation latency, detection time, degradation in text quality, or robustness\". However, there are many mis-interpretation of prior token-level watermarking methods. See \"Relation To Broader Scientific Literature\" for details.\n\nThe theoretical claims are not rigorously proved. See \"Theoretical Claims\".", "methods_and_evaluation_criteria": "It makes sense.", "theoretical_claims": "The theoretical justification for GaussMark relies on a problematic approximation: \n\n$\\log\\bigl(p\\_{\\theta+\\xi}(y|x)/\\mathbb{E}\\_{\\xi^{\\prime}\\sim\\nu}\\bigl[p_{\\theta+\\xi^{\\prime}}(y|x)\\bigr]\\bigr)\\approx\\langle\\xi,\\nabla_\\theta\\log p_\\theta(y\\mid x)\\rangle$. \n\nAuthor claim that this approximation is valid only under the assumption that $\\sigma \\ll 1$ and that the higher-order terms, particularly $\\frac{\\sigma^2\\left\\|\\nabla_\\theta\\log p_\\theta(y\\mid x)\\right\\|^2}{2}$, are negligible.\n\nHowever, the norm of the gradient, $\\lVert\\nabla_\\theta\\log p_\\theta(y\\mid x)\\rVert$, is substantial in realistic scenarios with long generated texts and complex, high-dimensional language models.\n\nThe paper does not adequately address the conditions under which this approximation remains valid for practical LLMs and text generation lengths.  The claim of $\\sigma \\ll 1$ being sufficient is likely too simplistic, and a more stringent condition, possibly dependent on text length and model complexity, like $\\sigma\\ll\\frac{1}{L\\sqrt{n}}$, might be necessary for the approximation to hold, a consideration absent in both the theory and experimental analysis, as all following bounds builds upon such approximation.", "experimental_designs_or_analyses": "No issues identified.", "relation_to_broader_scientific_literature": "In the abstract and introduction, the authors argue that previous methods suffer from issues such as generation latency, detection time, text quality degradation, and lack of consideration for text structure. However, some of these claims regarding prior works are exaggerated or inaccurate. For example, the paper criticizes methods like Kuditipudi et al. (2023) for \"extremely slow generation and detection,\" which is a mischaracterization. Kuditipudi's approach, based on manipulating logits and using efficient hash-based detection, is actually quite fast. Furthermore, the claim of text quality degradation in token-level\n watermarking is also misleading, e.g. \"Unbiased Watermark for Large Language Models,\" have been developed to avoid performance drops. \n\n\nThe paper's also claim that prior token-level watermarking methods ignores  \"inherent structure of text\" and GaussMark addresses that by embedding watermarks into model weights is vague. It's not evident how this directly leverages or incorporates the inherent structure of language itself, as opposed to, for instance, semantic watermarking. On the other hand, semantic-based watermark, as seen in \"Watermarking Conditional Text Generation for AI Detection: Unveiling Challenges and a Semantic-Aware Watermark Remedy\", explicitly handle the language structure. Even though this paper cited some semantic watermark works, it only discuss its relationship with paraphrasing attacks, and didn't compare two approaches in terms of language structure.\n\n\nTherefore, the paper's initial framing of the problem and the necessity for a fundamentally different approach like GaussMark is built upon a somewhat flawed understanding of the current state of the art.", "essential_references_not_discussed": "See above points for mis-interpretation of prior works.", "other_strengths_and_weaknesses": "One notable strength of GaussMark is its novelty. While previous watermarking techniques often manipulate the token sampling process at the logits level, GaussMark takes a different approach by directly perturbing the model's parameters. This departure from logits-based and investigation on adding noise into model parameters manipulation is indeed novel.\n\nDespite the novelty, GaussMark exhibits several weaknesses concerning its problem framing and theoretical foundation.", "other_comments_or_suggestions": "No other comments.", "questions_for_authors": "Why does TPR saturate in Figure 2a?\nIs it possibly because the fundamental approximation eq (3) of both theory and method became invalid in long sequence?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PSRI78LqCK", "reviewer": "Reviewer_36HD", "summary": "This paper proposes a watermarking scheme for large language model output (LLMs) using gradient-based test statistics. The properties of the proposed method, GaussMark, are analyzed theoretically to derive signficance levels and power of the test. The method and its properties (efficiency, quality-preservation, and detectability) are empirically verified using three language models.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their careful attention to our work.\n\n## Comparison to other watermarking schemes\n\nDue to space, we deferred an extensive comparison with Kirchenbauer et al to appendix H, alluded to in the paragraph beginning in line 406.  Please see that for results and explanation of why we chose this scheme as a benchmark.  We are happy to move some of those comparisons to the main body subject to space constraints.\n\n## Linear approximation\n\nWe emphasize that while our motivation and power bounds rely on simplifying assumptions, in Proposition 3.1, *the statistical validity of the test holds without assumption*, in particular not requiring the linear softmax approximation to hold.  The power bound is a theoretical result to guide our understanding of the effect of problem parameters, but is not directly relevant to practice; we verify empirically that Gaussmark has good power in detecting watermarked text.  The discussion following Proposition 3.3, wherein we take $\\sigma \\to \\infty$, is meant to serve as a guide for intuition and we give a finite bound on how large $\\sigma$ must be in Corollary I.5, to which we allude in line 298.  Furthermore, this intuition is reflected empirically in Figure 7, where we see that when variance is high for early layers we see a *decrease in power, manifesting through increased p-values when the variance increases*, suggesting that the lack of linear approximation hurts the test’s power.  In the revision we will include additional discussion clarifying this point.  \n\n## Memory Requirements\n\nWe agree that a full backward pass requires more memory than a forward pass, but we only keep track of gradients with respect to a single parameter matrix, usually in a late layer.   We are happy in the revision to clarify that choosing a parameter at a much earlier layer results in additional memory as well as provide empirical results on the memory cost of detection relative to inference.\n\n## Choice of parameters depending on benchmarks\n\nWe believe there may be some confusion as to when a validation set is important.  Our goal is to find watermarking parameters that do not adversely affect model quality (as measured by the chosen benchmarks) while still ensuring detectability, not to claim generalization.  As such, including the entire benchmark set in evaluation is *more stringent* as it reduces the standard error of the estimate of model quality, requiring the watermarked model to perform better relative to the benchmark in order to qualify as a model that does not reduce quality.\n\n## Relation to Pawelczyk et al 2025\n\nThank you for pointing this out; we agree the (very nice) work of Pawelczyk et al 2025 is relevant. We will discuss it in our revision, summarized here.\n\nFirst, we emphasize that while GUS perturbs *data* and takes gradients wrt inputs, GaussMark perturbs *parameters* and takes gradients wrt the same, as is appropriate for these very different settings.  Indeed, that work considers unlearning and thus aggregates the inner product test statistic over multiple data points on a model that is passed through some noisy channel induced by the unlearning process, while ours focuses on a fixed data point and evaluating the likelihood that this datum is generated by a watermarked model.  We make several novel theoretical claims: (1) We prove statistical validity under virtually no assumptions in the watermarking setting; (2) We prove power bounds in toy models that somewhat approximate LM’s and the intuition we glean from these broadly aligns with our empirical findings.  In addition to theory, we extensively evaluate our proposed approach empirically in a very different setting from the mentioned paper.  Furthermore, while that work does mention the blessing of dimensionality, they do this only in the Gaussian setting; this is subsumed by our strong log-concavity analysis but does not approximate the LM setting as well as the linear softmax model we consider.\n\nSecond, Section 3.1 discusses how our test is, heuristically, a computationally efficient approximation of the minimax optimal test, giving theoretical grounding to our approach.  In particular, GaussMark naturally emerges as the ‘right test’ for structural watermarking rather than being directly inspired by GUS. In fact, the resemblance of the two suggests that the GUS may be theoretically grounded as well, although this direction appears out of scope for that paper.  \n\nTL;DR: we agree this work is relevant and will add a discussion and proper reference to  Pawelczyk et al 2025 in the revision, but we disagree that the existence of the aforementioned work diminishes the novelty claim. \n\n## Necessity of knowing model gradients\n\nThis is a good point and is acknowledged as a limitation in line 415, 2nd column.  Please see that paragraph for why we believe the white-box setting is reasonable.\n\n## Questions\n\nThank you for catching the typo in the caption.  Please see our response to XB7Z regarding quantization.", "claims_and_evidence": "There are four main claimed properties of the method, GaussMark\n\n* It is statistically provable. I found no substantial flaws in the theory part, but the derivation relies on coarse assumptions that might not hold for real-world models. For instance it uses a linear approximation. \n* It does not deteriorate the quality of the outputs. I think the references and the empirical results support this point well. However, I think this should rather depend on the layer or the model where GaussMark is applied. But generally I am convinced that the method can be applied to models without deterioration in quality\n* It is robust to simple post-processing techniques. Empirically verified through experimental evaluation, but no theoretical results concerning this point. \n* It is very efficient. I think this claim is established well (it is conceptually straightforward to see) and experimentally demonstrated in Figure 3. However, I profoundly disagree with the claim that detection has the same memory requirements as inference made (in Section 5, l.434). For detection, a backward-pass is required which usually consumes substantially more memory.\n\n\nHowever, as the authors acknowledge, there are already a lot of watermarking approaches in the literature. I think this necessitates further competitive comparison concerning the key criteria: detectability, performance-degradation, and robustness to modifications. There is no direct comparison to any method in the main paper. This is an essential weakness to me as I think this contribution needs to be judged in relation to existing methods.", "methods_and_evaluation_criteria": "I found no major issues with the experimental setup besides lack of baselines.", "theoretical_claims": "The paper contains a potentially concerning theoretical inconsistency regarding the noise parameter σ:\n\nIn Section 3.2 (before Proposition 3.3), the authors justify the linear model assumption by arguing it holds when σ is \"sufficiently small\"\nLater, when discussing results, they analyze the case where σ → ∞, and state that larger sigmas are required for the method to work properly.\nThis contradiction undermines the theoretical foundation of the work. Which condition is actually required for the method to function properly? The paper needs to resolve this fundamental inconsistency.\n\nThe entire method seems to rely on the assumption in eqn. (3) that seems relatively coarse and drastic. Details of the approximation are deferred to the Appendix, but I think this part is crucial to understand the statistical grounding and reliability of the method.\nI have the impression that a lot of theoretical effort was invested in a method that is based on this uncertain approximation. Therefore, I am not sure how valueable the theoretic results are in practice.", "experimental_designs_or_analyses": "There seems to be on issue regarding hyperparamter selection: The hyperparameter values (sigma, and selection of layer) are not independent of the benchmarks, as it seems the same data and metrics were used to select them as far as I understand. It would be more sound to use a validation subset of the benchmark for selecting sigma/the layer according to the performance.", "relation_to_broader_scientific_literature": "The methodology and the test statistic appears to be directly adapted from Pawelczyk et al. (2025), \"Machine Unlearning Fails to Remove Data Poisoning Attacks\" (ICLR 2025; preprint available since June 2024), which established a nearly identical test statistic approach using Gaussian samples and input gradients. The current work essentially applies this existing methodology to LLM watermarking without proper acknowledgment. Even the key insight regarding improved performance with higher input dimensionality was previously established in the ICLR 2025 paper. The absence of proper citation and comparative discussion substantially diminishes the novelty claim.", "essential_references_not_discussed": "see above, otherwise I just think more methods should be studied empirically.", "other_strengths_and_weaknesses": "Writing and Clarity: The (main) paper is very well-written, besides a little too many references to the appendix, especially in the theoretical statements. Some parts, especially at the end of Section 3, just read like a concatenation of references to the appendix, which is not a nice read. In terms of the contents, think the paper could also fit a journal format well. There is a lot of theory in the appendix. I don’t think the theoretical contribution fits the conference review format as it would be very time-consuming to completely review.\n\nScope: A fundamental limitation of the proposed method is its requirement for access to model gradients. Most watermarking schemes derive their utility from working with black-box API access – for instance, when detecting if students have used ChatGPT or Claude for assignments. Since this method requires gradient access, it cannot be applied to the predominant use case of commercial API-accessible models, severely limiting its practical impact.\n\nOn the positive side, I appreciate that the proposed water-marking method is straightforward to implement and has no overhead in generation time. The topic of watermarking further is timely and relevant.\n\n**Summary** While the approach shows some interesting theoretical properties and can be easily implemented, there are concerns regarding a performance comparison to other methods, novelty in contrasts to earlier works using similar statistics, practicality/scope, and theoretical consistency that significantly impact its contribution.  While the paper's execution and writing is generally good and the topic is timely, I currently cannot provide an accept score because of the many issues raised.", "other_comments_or_suggestions": "## Rebuttal update \n\nincreased score from 2 -> 3 based on rebuttal (see below)", "questions_for_authors": "*  Captions in Figure 5: Why are the x axes labeled “Size of test” in Figure 5? I think these are TPR/FPR curves, right?\n\n*  To preserve utililty, the variance of GaussMark has to be chosen very small (e.g., 1-e5). For efficient generation quantization of weights is common. However, when using quantized models, e.g., with 16-bit floats, the variance used is far lower than o the representable precision (machine epsilon for fp16 is around 1e-3). Do you think for GaussMark’s performance full-precision computations are necessary?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4DOXx2ouvr", "reviewer": "Reviewer_XB7Z", "summary": "This paper introduces GaussMark, a novel watermarking scheme for language models. The approach involves adding small Gaussian perturbations to a single MLP layer during generation and using statistical tests based on Gaussian independence to detect watermarked text. The watermarking scheme comes with formal statistical guarantees and is efficient to implement in practice. The authors test GaussMark on Llama3.1-8B, Mistral-7B, and Phi3.5-Mini, showing it can effectively watermark text while maintaining performance on the SuperGLUE, GSM-8K, and AlpacaEval-2.0 benchmarks.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their careful attention to our work.\n\n## Choice in Perturbation Parameters\n\nWe agree with the reviewer that a more thorough understanding of which parameters to perturb would be beneficial and included Figures 7-12 as some empirical guide as to the effect of layer, parameter, and variance on both detectability and model quality.  At present, we do not have a strong theoretical intuition for which parameters are optimal to watermark beyond the notion that higher dimensional parameters with variance neither too high nor too low work the best.  We suspect, as we allude to in Line 438 2nd column, that the optimal choice is to perturb multiple weights at once and it is an interesting direction for future research to better understand and develop a more general intuition for this question.\n\n## Validity of linear softmax assumption beyond transformers\n\nThis is a good empirical question and we are not sure as to the answer as we only experimented with transformer architectures.  We suspect that recurrent networks likely have complicated nonlinear effects that may reduce the power of Gaussmark, but that convolutional operations, being linear, may still allow for the linear softmax assumption to apply, at least in later layers, but this is entirely guesswork and this is an interesting direction for future work.  Note that this approximation is only important to theoretically bound the power of the test, and statistical validity holds unconditionally.\n\n\n\n## Quantized models\n\nThe question of precision is very good and we did not experiment with this so we are not sure of the implications.  We suspect that our method would still work (although possibly with reduced power) as several weights can handle larger variance without reducing text quality (cf. Fig 11-12).  Optimizing Gaussmark for quantized models is an excellent direction for future work.", "claims_and_evidence": "The paper's claims are generally well-supported by both theoretical analysis and empirical evidence.\n- Statistical validity: The authors provide formal proofs about the power of the GaussMark test under an assumption that the language model can be approximated as a linear softmax model.\n- Minimal impact on generation quality: The empirical evaluations on SuperGLUE, GSM-8K, and AlpacaEval-2.0 convincingly demonstrate that GaussMark has minimal impact on model performance.\n- Efficient implementation: The timing measurements clearly show that GaussMark has negligible impact on generation latency and reasonable detection time, outperforming alternative approaches like KGW by orders of magnitude in generation time.\n- Robustness to corruptions: The paper presents evidence that GaussMark is somewhat robust to token-level corruptions and roundtrip translation, though it is less robust than some alternative approaches (e.g., KGW-2).", "methods_and_evaluation_criteria": "The methods and evaluation criteria are appropriate and very comprehensive.\n- The evaluation across multiple models (Llama3.1-8B, Mistral-7B, Phi3.5-Mini) provides good coverage of different model sizes and architectures.\n- The benchmarks (SuperGLUE, GSM-8K, AlpacaEval-2.0) appropriately assess different aspects of model quality.\n- The corruption experiments (token insertion/deletion/substitution, roundtrip translation) are comprehensive and test realistic scenarios.", "theoretical_claims": "I checked the high-level proof ideas for the main theoretical claims in the paper, Propositions 3.1 and 3.3. The theoretical claims in the paper appear sound as far as I can tell and use standard statistical techniques.\n- Proposition 3.1 (statistical validity) uses the rotational invariance of Gaussian distributions to show that the test statistic follows a standard normal distribution under the null hypothesis.\n- Proposition 3.3 (power bound) derives bounds on the statistical power under the linear softmax model assumption. The authors are careful to state the details of their assumptions and Lemma I.6 justifies why this assumption may be reasonable in practice.", "experimental_designs_or_analyses": "The experimental designs are sound and comprehensive.\n- The authors use standard benchmarks and datasets (C4 for generation, SuperGLUE, GSM-8K, AlpacaEval-2.0 for evaluation).\n- Ablation studies thoroughly explore the effects of different hyperparameters.\n- Error bounds and multiple seeds are used to account for stochasticity.\n- Corruption experiments (token insertion/deletion/substitution, roundtrip translation) are comprehensive and systematically test different types and levels of text modification.\n\nOne minor limitation is that the generation evaluation could benefit from more diverse text domains beyond just C4.", "relation_to_broader_scientific_literature": "The paper is well-situated within the watermarking literature for language models. The authors situate their work clearly within the landscape of prior work and clearly identify their novel contributions:\n- Unlike token-level approaches like Kirchenbauer et al. (2023) and Kuditipudi et al. (2023), the proposed method makes edits to (few) model parameters.\n- The authors mention drawing inspiration from work on model weight manipulation, including model soups (Li et al., 2023; Sun et al., 2023; Fernandez et al., 2024; Sharma et al., 2024).", "essential_references_not_discussed": "I am not aware of other key references that are not discussed.", "other_strengths_and_weaknesses": "Other strengths:\n- The paper is comprehensive and clearly written.\n- The method is practical, with little computational overhead, and easily deployable, requiring no modifications to inference pipelines.\n\nWeaknesses:\n- The method is not as robust to more sophisticated attacks (e.g. roundtrip translation). Other attacks, e.g. targeted or non-consecutive paraphrasing could be more thoroughly explored.\n- The paper could benefit from more detailed discussion about the effect of the choice of model parameters to be perturbed, see questions.\n- The method may not be as applicable to smaller models, where weight perturbations may have larger effects.", "other_comments_or_suggestions": "I think the paper is generally very well written. One minor suggestion is that in my opinion the main text could benefit from a slightly more thorough description of the method hyperparameters $\\sigma$ and $\\theta$, see questions.", "questions_for_authors": "1. How valid is the linear softmax assumption for models that differ from the standard Transformer architecture, e.g. convolutional long-context models or models that combine global and local operations (e.g. sliding window attention)? This may be crucial for determining whether the method may lead to greater performance degradation on different models.\n2. Do the authors have a general method for choosing $\\sigma$, the noise variance, and $\\theta$, the model parameters on which to apply the watermarking procedure, beyond simply testing the different options empirically?\n3.  Have the authors investigated how well GaussMark performs on models that have undergone quantization or other post-training modifications? This may be relevant for deployment scenarios where models are often compressed for efficiency.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Y9ah8QKQZW", "reviewer": "Reviewer_x6rs", "summary": "This paper proposes a watermarking for large language models. The watermarking injection process has an almost negligible overhead and applies to LLMs of any structure. The authors observed that a small perturbation to the parameters of LLMs will not significantly affect the model's performance. Based on this, the authors inject the watermarking into the model's weights. Specifically, in the watermarking injection phase, sample the watermarking from the Gaussian distribution, then add it to the parameters of the model (similar to model merging). In the detection phase, based on hypothesis testing, the watermarking is detected by calculating statistical information related to the gradient of the parameter part of the watermarking injection. A lot of theoretical analysis is done in the paper, and experiments show that this watermarking has advantages in detection success rate, impact on text generation, and anti-attack.\n\n## Update after rebuttal\n\nThe concern about \"the effect of increased noise on model performance is not provable\" has not been solved, so I maintain the original score.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their careful attention to our work.\n\n## Model Quality: Further benchmarks and safety\n\nWe agree that more benchmarks, such as translation or code, would be better and we acknowledge in lines 407-408 2nd column that such checks are necessary before deployment.  We also agree that safety benchmarks would be beneficial to consider.  On the other hand, note that the suite of evaluations we did perform approximately matches or exceeds much of the empirical watermarking literature and the realities of resource constraints surrounding compute limit our ability to conduct a wider sweep.  We agree that considering the effect of GaussMark on safety is an interesting direction for future research.\n\n## Further corruption attacks and detection of multi-round conversations\n\nRegarding further corruption attacks, we agree that more sophisticated attacks would be interesting to study, but again note that the set of attacks we did investigate is fairly large relative to many of the other works proposing watermarking schemes.  In particular, emoji attacks amount to structured token-level insertions and are likely less able to damage GaussMark than the random insertions we did investigate.  While certainly more sophisticated document-level attacks are relevant to the investigation, note that we simulate a weaker version of this attack by adding random text to the beginning of the examined corpus.  Further experiments are, of course, always better, but are subject to the same resource constraints mentioned above.\n\nOn the subject of multi-turn dialogue, we believe that this is partially addressed by our discussion in lines 376-381 2nd column, where we mention that ignorance of the prompt does not substantially affect our ability to detect the watermark.  For more detailed discussion of our robustness experiments, please see Appendix F.\n\n\n## Typos\n\nThank you for catching these; we will fix them in the revision.", "claims_and_evidence": "The core innovation of the paper and the analysis of experimental conclusions are clear.", "methods_and_evaluation_criteria": "This paper has used multiple datasets to empirically demonstrate the negligible influence on the original model. However, this evaluation method is ultimately limited, for example, the effect of the added parameter noise on the safety alignment of the model is not considered.", "theoretical_claims": "The reviewer has checked the correctness of the core theoretical claims of the paper.", "experimental_designs_or_analyses": "The reviewer has checked the soundness and validity of the experimental designs. The experimental setup and analyses are reasonable.", "relation_to_broader_scientific_literature": "The paper introduces the related work in detail and the proposed method is novel.", "essential_references_not_discussed": "The discussion on the robustness of the LM watermark is necessary, and diverse adversarial attacks against the watermark can be found in [1].\n\n- [1] Liu, et al. On Evaluating The Performance of Watermarked Machine-Generated Texts Under Adversarial Attacks.", "other_strengths_and_weaknesses": "Strengths:\n\n- It is simple to implement the proposed watermark algorithm. Watermarking injection and detection do not require much memory and computational overhead.\n\n- Rich theories to prove the correctness of detection metrics.\n\n- The redundancy of weight information is used to directly add watermarking to weights without forcing the selection of tokens, which maximizes the retention of language characteristics. Experiments have also proved this.\n\nWeaknesses\n\n- The reviewer's biggest concern is that the effect of increased noise on model performance is not provable, so there is a possibility, though a very low probability, of damaging model performance.\n\n- The choice of parameters of watermarking and the location of watermarking injection rely on experience, so extensive experiments are needed to prove the applicability of experience, which includes more models and more different types of datasets, such as translation and code.\n\n- Need more types of attacks to detect the robustness of watermarkings, such as emoje-attack or document-level attacks that copy text to large amounts of human text.", "other_comments_or_suggestions": "- Detailed discussion and analysis are needed to prove small perturbations cannot destroy the safety alignment of the model.\n- In the watermarking detection phase, it is necessary to obtain the user's prompt, which is almost impossible in practice due to privacy and timeliness. Although the experiment considers the case of prompt damage, this is also under the condition of knowing the real prompt.\n- The watermark detection algorithm and the examples are all based on single-round dialogue scenarios. However, in actual situations, users often gradually guide the model in the form of multiple rounds of dialogue. In this case, how to detect the watermark? For example: \n    - user: please introduce the LLMs safety. \n    - assistant: LLMs safety includes ... (1000tokens) \n    - user: thank you, please summarize in one paragraph. \n    - assistant: ok, ...(400tokens)\n- Typos:\n    - The title of Figure 13-b does not match its horizontal axis.\n    - Should the horizontal and vertical axes in Figure 5 be TPR and FPR?\n    - The colors of low p-values in Figure 9 and 10 should be consistent.", "questions_for_authors": "Please see the comments and weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper introduces GaussMark, which is a new approach for watermarking LLMs. The main algorithmic idea of adding Gaussian noise to the input is simple but natural, the technical analysis that relies on a Gaussian independence test is highly trivial. Extensive experiments further demonstrate the applicability of this new approach.

After the rebuttal, most reviewers are pleased with this work. Therefore, I am happy to recommend its acceptance. We encourage the authors to incorporate the discussions and the promised revisions into the final version of this paper.
Decision: Accept (poster)