An End-to-End Model for Logits-Based Large Language Models Watermarking
Authors: KA HIM WONG
Jicheng Zhou
Jiantao Zhou
Yain-Whar Si
Venue: ICML 2025 poster (2025)
Keywords: LLM watermarking
End-to-end optimization
Robustness
Primary area: social_aspects->safety
TL;DR: We introduce the first logits-based end-to-end model for LLM watermarking, where encoder and decoder networks are jointly optimized to improve detection robustness and text quality.

Abstract: The rise of LLMs has increased concerns over source tracing and copyright protection for AIGC, highlighting the need for advanced detection technologies. Passive detection methods usually face high false positives, while active watermarking techniques using logits or sampling manipulation offer more effective protection. Existing LLM watermarking methods, though effective on unaltered content, suffer significant performance drops when the text is modified and could introduce biases that degrade LLM performance in downstream tasks. These methods fail to achieve an optimal tradeoff between text quality and robustness, particularly due to the lack of end-to-end optimization of the encoder and decoder. In this paper, we introduce a novel end-to-end logits perturbation method for watermarking LLM-generated text. By joint optimization, our approach achieves a better balance between quality and robustness. To address non-differentiable operations in the end-to-end training pipeline, we introduce an online-prompting technique that leverages the on-the-fly LLM as a differentiable surrogate. Our method achieves superior robustness, outperforming distortion-free methods by 37–39% under paraphrasing and 17.2% on average, while maintaining text quality on par with the distortion-free methods in terms of text perplexity and downstream tasks. Our method can be easily generalized to different LLMs. Code is available at https://github.com/KAHIMWONG/E2E_LLM_WM.

An End-to-End Model for Based Large Language Models Watermarking
Kahim Wong' Jicheng Zhou'
Jiantao Zhou'
Yain- Whar Si
Abstract
1. Introduction
The rise of LLMs has increased concerns over source tracing and copyright protection for AIGC, highlighting the need for advanced detection technologies.
Large Language Models (LLMs) like ChatGPT (Achiam et al., 2023), Llama (Touvron al., 2023; Dubey al., 2024), and OPT (Zhang et al., 2022) have greatly improved the quality of Al-generated content (AIGC). broadening their applications in fields such as translation (Hendy et al., 2023), content creation (Ni et al., 2023), etc. However, such rapid expansion has also raised concerns about copyright infringement, academic dishonesty, and unethical practices (Augenstein et al., 2024). These issues highlight the urgent need for reliable methods to distinguish between human- written text and I.L.-generater content, ensuring digital in- tegrity and combating misinformation (Barrett et al., 2023).
Passive detection methods usually face high false positives, while active watermarking techniques using logits or sampling manipulation offer more effective protection. Existing LLM watermarking methods, though effective unaltered content, suffer significant performance drops when the text is modified and could introduce biases that degrade LLM performance in downstream tasks. These methods fail to achieve an optimal tradcoff between text quality and robustness, particularly due to the lack of end-to-end optimization of the encoder and decoder. In this paper, we introduce novel end-to-end logits perturbation method for watermarking LLM --M--geeertted text. By joint optimization, our approach achieves a better balance between quality and robustness. To address non-differentiable operations in the end-to-end training pipeline, we introduce an maline-promptie technique that leverages the on-the-fly LLM differentiable surrogate. Our method achieves superior robustness, out- performing distortion free methods by 37-39% under paraphrasing and 17.2% on average, while maintaining text quality on par with the distortion- free methods in terms of text perplexity and downstream tasks. Our method can be easily gen- eralized to different LLMs. Code is available https:/ / thub. com/ KAHTMMONG, /F2.. F.2.. LLM.MM
Numerous approaches have been proposed to address LLM ethical concerns by detecting I.L.-generated content. Pas- sive detection methods focus on identifying unique proper- ties of generated text, often through training binary classi- fiers (Bakhtin et al., 2019; Jawahar al., 2020) statistical techniques like DetectGPT (Mitchell et al., 2023), which compares sentence's log-probability to that of a perturbed version. However, as LLMs improve and the gap between generated and Human-written text narrows, the effective- ness of these methods declines dramatically. In contrast, active detection methods, like embedding watermarks in generated text, are proving to be more robust alternatives. LLM watermarking methods fall into two main categories: logits-based and sampling- based. Specifically, logits-based methods (Kirchenbauer et al., 2023; Liu et al., 2024b; Huo et al., 2024) randomly divide the vocabulary into "green" and "red" lists by hashing preceding tokens as the seed. Then, perturbations green list tokens in the generated text, and the proportion of the "green" tokens is used to distinguish whether a text is L-g-geeerated. Sampling bampling-based based methods (Kuditipudi et al., 2024; Christ et al., 2024) rely on random bitstream to guide token sampling, creating detectable correlations in the text. Despite advancements, current watermarking schemes experience significant performance degradation with even slight text modifications. Additionally, existing algorithms introduce logit biases guide sampling through random bitstream, which would result in semantic differ- ences between watermarked and non non-watermarked content,
introduced to the logits that favor
'State Key Laboratory Internet of Things for Smart City, Department of Computer and Information Science, Faculty of Science and Technology, University of Macau, China 'Department of Computer and Information Science, Faculty of Science and Technology, University of Macau, China. Correspondence to: Jiantao Zhou <jtzhou@ um.cdu.mo>.
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
negatively impacting LLM performance on downstream tasks, and limiting the practicality of these watermarking techniques, Among logits- methods, there is growing trend to replace the hashing schemes with trainable networks for generating logit perturbations (Liu et al., 2024b; Huo et al., 2024), and to substitute statistical decoding with train- able decoders (Liu et al., 2024a), leveraging the flexibility of neural network training to improve performance. However, these existing approaches still fail achieve optimal trade-off between text quality and robustness, primarily due to the separate training of the encoder and decoder rather than a joint, end-to-end optimization.
2. Related Works on LLM Watermarking
Recent works on LLM watermarking can be classified into two main categories: logits- based and sampling- based meth- ods. Logits-based methods, as presented in KGW (Kirchen- bauer al., 2023), split the vocabulary into "green" and "red" lists by hashing preceding tokens and biasing green list logits to favor their selection, using the proportion of green tokens to detect watermarks. Building on KGW, several methods aim to improve the robustness, quality, or unforge- ability of the watermarked text. KGW-R (Kirchenbauer et al., 2024) explores different hashing schemes, while Uni- gram (Zhao et al., 2024) uses fixed red-green separation to enhance editing resistance. SWEET (Lee et al., 2023) selectively modifies logits at high-entropy tokens to im- prove quality in low-entropy scenarios such as the code generation. UPV (Liu et al., 2024a) employs an encoder network to split lists and a detector network for classifi- cation, enabling public detection. SIR (Liu et al., 2024b) trains encoder apply context-aware biases for better robustness, and TSW (Huo et al., 2024) uses two networks to adaptively adjust watermark strength and list-splitting ratio for better balance between detectability and text qual- ity. DiPmark (Wu et al., 2024) enhances selected token probabilities by applying a distribution-presevvin reweight function. Sampling-
With this observation, we introduce a novel logits logits-based and-to-end model, where lightweight encoder and decoder networks are jointly optimized to enhance both detecting ro- bustness and text quality. Note that building such an end-to- end system is highly non-trivial because many involved mod- ules, such as the complex text modification and the semantic loss computation, are inherently non-differentiable. To re- solve these challenges brought by the non- non--fferretiabiiityy we introduce a novel online prompting technique that uti- lizes the on-the-fly LLM as a differentiable surrogate. This approach enables the model to effectively handle the above- mentioned non-differentiable operations. Our framework is LLM-agnostic, allowing any LLM to be used during train- ing, and once trained, the model can be applied to other LLMs without retraining.
methods, such as EXP (Kudi- tipudi et al., 2024), use pseudo-random bitstream guide token selection through inverse sampling. This process pro- duces watermarked text that aligns with the bit sequence and makes detection accurate. EXP-Edit (Christ et al., 2024) builds on the EXP method by introducing edit distance to measure sequence alignment, enhancing robustness against tampering. Unbiased (Zhao et al., 2024) employs inverse sampling and permutation- based reweighting for watermark- ing but relies LLM API logits and generation prompts, reducing its efficiency. Nevertheless, as will be shown, cur- rent LLM watermarking methods suffer from significant drops in detection performance when the text is modified and can introduce biases that impair LLM performance, such as the translation and the code generation.
Our key contributions are as follows:
We present a novel logits-based end-to-end model for LLM watermarking, improving detection robustness and text quality through encoder-decoder joint opti- mization.
We introduce a new online prompting technique that transforms oon-differentiable operations, such se- mantic loss calculation and advanced online text modi- fication, into differentiable operations by dynamically prompting the on-the-fly L.M. This technique enables seamless end-to-end training without external models.
3. Method
Extensive experiments show that our method achieves superior robustness, outperforming distortion-free free methods by 37-39% under paraphrasing and 17.2% on average, while maintaining text quality on par with these distortion-free methods in terms of PPL and downstream tasks. Notably, our method can be gener- alized across LLMs without additional training.
In this section, we detail our LLM watermarking solution, which improves the balance between robustness and text quality, compared to existing methods. We begin by outlin- ing LLM and logits-based watermarking basics, followed by the structure and objectives of our model and the online prompting technique. Finally, we introduce plug-and-play converter for cross-LLM inference.
The paper is organized as follows: Sec. 2 reviews related works on LLM watermarking. Sec. 3 details our proposed method. Sec. 4 presents experimental results demonstrating the superior performance of our method. Finally, Sec. 5 concludes the paper.
First, let us give a brief overview of the LLM workflow and the logits-based method. Given a prompt X prompt = [xi...., xx), an LLM M generates tokens in an autoregres- sive manner. At each time step t, M produces a proba-
2

---

end training. Once the stop criteria are reached, the tire watermarked sequence Xwm is generated, and the on- line text editor N augments the text to simulate user ed- its, resulting in Xwm = N (Xwm), which is then passed to the decoder D to detect the presence of the watermark mn = D(X E {0, 1}, where "0" indicates no water- mark and "I" indicates the presence of the watermark. The same prompt X propps fed into the standard LLM pipeline with M to generate the wotermaardr sample X for An End-to-End Model for Logits-Based Large Language Models Watermarking
Freszed Param.
Add
Watermark Embedding
Prompt
Entire Sequence
Generated Sequence
p
jm
M
X nwm
No Faram.
Forward
Tolsen
Stop Grad.
M
opp
GSS
XX
X
X
X
Xx-1
(b) Online Text Editor
(c) Watermark Detection
Context
Window
m
Infer?
E
Stop?
Yes
X
wm
N
* wm
Infer?
No
D
Yea
No
Yes
C
(d) Converter for Cross-LLM Inference
Figure Overview of our and-to-end model, consisting of (a) watermarking logits perturbation with encoder E:; (b) simulating user edits using the online text editor N; and (c) detecting watermarked content through decoder D. The entire model is trained end-to-end optimize both the quality and detection accuracy the watermarked content. In the inference phase, (d) a converter is deployed for cross-LLM adaption. GSS is the abbreviation of the Gumbel-Softmax sampling.
bility distribution for the next token PM (x,[Xx11, Xi..... x over vocabulary V (ti..... t then the token X2
sampled from Pas (x,) In this process, logits 1(t)
(1t)) ,i.,, 1 E RlM refer to the unnormalized output by
M before converting into probability
exp(1
pM = tI|xI, xt-1)=
Once the stop criteria are satisfied, the user receives a gen- erated response Xmwm- To embed watermark into the generated text, logits-based methods introduce a watermark logits 152 at each generation step with strength 8, resulting in the perturbed logits: j(t) (tt) 5 - By adjusting the logits favor tokens in the green list, which is determined by hashing preceding tokens, the method increases the prob- abilities of sampling green-list tokens. Consequently, the watermarked text Xwm contains a higher proportion of these favored tokens, creating a detectable statistical cue that is not present in human-wriin written content.
D. The networks are jointly trained, with E updated via backpropagation from D. After the model is trained, a con- verter C is appended before both F and D for cross-LLM inference.
3.2. Watermark Embedding
We illustrate the watermark embedding process of our method, as shown in Fig. 1 (a) colored with light blue. Similar to KGW, our approach embeds a watermark on the generated text by biasing the original logits. Instead of using context token hashing to determine the bias, employ lightweight network E to implicitly learn water- mark logits by minimizing the detection loss Lave for D and the semantic loss Zeem between Xwm and X However, constructing such an end-to-end pipeline poses challenges due to the non- con-differentiable modules involved, including the token sampling process, the online editing of Xwm- and the computation of L To address this, implement several alternatives, including using GSS to replace the non- differentiable sampling. Additionally, we propose an online prompting technique to perform online editing of X as well as extract semantic embeddings to compute Zvem by dynamically prompting the on-the-fly LLM.
We are now ready to present the details of our end-to-end watermark method.
3.1. Model Overview
The architecture of our proposed method is depicted in Fig. At each time step 6, the encoder E takes the context ((t) -x-1-w..... X1-1] from local window W and the current logits ((t) from the on-the-fly LLM
M to generate the watermark logits 1ff E(C(O), The next token is then generated with the perturbed log- its j(t) = ((t) + 8 164 based on Gumbel-Softmax sam- pling (GSS) to enable differentiable sampling for end-to-
3

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
Prompt For Text Modification
Prompt For Semantic Embedding
X wm
M
X nwin
00000000000
Prompt Semantic Embedding
win
M
Sem
Similarity
Rewrite the following paragraph:
000
Now rewrite the above paragraph uph::
meuns one worrd.""
N
In-context Learning Example
This sentenice: "A jockey ridling a horse. meeuns in une word. Equesttiin" This sentence
(a) Online Prompting for on-the-fly text editing
(b) Online Prompting for sem
Figure 2. Online prompting technique for (a) computing semantic loss and (b) on-the-fly fly text editing. The prompts are first converted into the embeddings and then concatenated with generated text Xwm Xowm.
We now formulate the data flow of the watermark embed- ding process, each time step i, the encoder receives the context C(t) and the current logits [(() generate the water- mark logits w across the vocabulary V. The encoder con- | where each sequence is formed by s(t) = [C(1) t.j. Never- theless, due to the large size of V. processing all sequences computationally expensive. For efficiency, we focus on the top-k logits tokens ..,,...; ... li and form the top-k kop-k ! ..... 1 in which {i), .2,..... i the index of the top-k logits tokens. multilayer per-
the token embedding matrix of V. The watermark signal is embedded at each generation step until the stop criteria are met and the watermarked sample X is obtained.
siders all possible token sequences ( [s(4)
3.3. Online Text Editing
shown in Fig. (b), the online text editor N (in light pur- plc) is positioned between the encoder and decoder during training to simulate user edits of watermarked content, en- hancing detection robustness. We utilize the online prompt- ing technique in Fig. 2 (a) to augment watermarked text by dynamically prompting the online LLM M. This approach effectively handles non-differentiable online text modifica- tions, such as rewriting. Specifically, after generating wa- termarked text Xum. it fed into N produce X Xum- The editing prompt: Rewrite the following paragraph: [text] Now start rewrite the above paragraph: instructs M to generate an augmented version of the watermarked content, where [text] ] is a placeholder for X Thus, (X..m) is equivalent to M ([Xeph. Xwm, Xepe)) in which Xeph and Xepe denote the beginning and the end of the editing prompt. In contrast to existing online text editing methods, such as random token dropping/adding (Zhang et al., 2024), our approach shows significantly improved robustness seen distortions due to the capabilities of the on-the-fly M to perform more complex modification on the text (more examples are provided in Appendix C.4). While external paraphrasing models like Dipper (Krishna et al., 2023) are available, differences in tokenizers between the LLM and these models render the operation non-differentiable.
quences s(t)
ceptron (MLP) fmpp maps the input sequence ( to the watermark logits of the top-k tokens:
lop tanh(Te Smp((S k)p
(2)
where tanh bounds the output within [-1, 1] and the param- eter Te adjusts the sharpness of tanh. As visualized by 1(4) in Fig. (a), with logits of token close to belonging the "red" list and indicating the "green" list. Except for the top-k tokens, the watermark logits of the remaining tokens (can be considered in the "grey" list) are padded with 0 to form (e)
By adding up watermark logits on the original logits with strength 8, we obtain the perturbed logits ((9) Then, GSS (Jang et al., 2017) is used to allow the sampling step dif- ferentiable, mimicking the standard L.LM sampling and enabling end-to-end training. Specifically, Gumbel noise gi log(- log(U:)), where U Uniform(O, 1), is added to each logit, yielding j(t) = j(()) + The logits i(t) are then passed through the softmax function:
3.4. Watermark Detection
As shown in Fig. (c), a lightweight network D (in green) is used to classify whether given text is watermarked or not, allowing end-to-end training for more robust detection compared to purely statistical methods. X (altered or unaltered) and X are fed into D, which predicts whether the text contains a watermark vi = ()). For efficiency, D
(x.) = exp((1") +g//Tg)
(3)
ΣV= exp((1.) + )))
where g is a vector of Gumbel noise with the same shape as i(0) and Ty controls the sharpness of the softmax. The next token embedding is computed as X; = Phy E, where E is

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
is built with LSTM layers and an MLP classification head.
After training EMg and Dir, on a specific LLM Mo using the end-to-end pipeline, we consider the generalizability of our method to other LLMs. Due to unique tokenizers and embedding dimensions, Eig, and DMo cannot be directly applied to another LLM M1. To address this, we intro- duce a converter C' that transforms embeddings from M1 to Mo. as located in Fig. (d) and detailed in Fig. 3. This process involves converting Mj embeddings to the text do- main and then back to Mo embedding space. The converter is positioned before EM, and DM enabling cross-LLM watermark embedding and detection as FiM (CM,-Mo Mo (S)) and DM, (C..-Mo (X)), respectively. Our encoder accepts a fixed number of context tokens, requiring careful token management due to the variability token segmentation across different tokenizers. To ensure that the transformed context tokens exceed the original length, we dilate the con- text window W by factor of and then truncate the latest context to maintain the appropriate length W.
3.5. Training Objectives
The entire end-to-end system is supervised with two ob- jectives: detection loss Las and semantic loss Liem- The detection loss Ldec, which is computed using cross-entropy between the prediction and the ground-truth label to detect the watermark signal accurately. Additionally, to preserve the capabilities of the original LLM, Luem ensures that Xmm retains the same semantics as X Semantic loss can be typically computed by the distance between embeddings which are extracted from an external semantic model fsem. such that Onwm See (xmm) and 6ym Ssem [sem(X Xm). and the loss can be computed by
(Cawm: @wm)
Lesem( (Cawm: Owm)
=
(4)
|Cawm la //C/mmll
OPT
and
Still, extracting the embeddings Cawn and Owm is non- differentiable. Unless the online L.M M and the seman- tic model fsem share the same tokenizer, the embedding mapping between the two is not bijective, complicating the transformation from M to the fsem domain. To ad- dress the issue, we avoid external models for computing semantics and instead prompt the on-the-fly LLM to ap- proximate fsem- Fortunately, recent studies have shown that LLMs can generate semantic embeddings with quality comparable to dedicated semantic models using prompt en- gineering, without the need for fine-tuning (Jiang et al., 2023). We leverage this LLM ability to compute Crem directly, enabling end-to-end training and resolving non- differentiability issues. As illustrated in Fig. 2 (b), Xwm and x.wn are generated in parallel at the generation phase, and a prompt with an in-context learning example: This sentence: "A jockey riding a horse." means in one word: "Equestrian". This sentence: " "[text]" " means in one word: " guides the on-the-fly LLM to extract semantic em- beddings. [text] is the placeholder for Xnwm or Xwm, and the embeddings Cawm M ([ Xnwm: X.ee)) and Cwm M[x Xwm: X)pel) are extracted, where X.pb and Xspe are the beginning and the end of the above prompt. Finally, frem is computed by the cosine distance between the two embeddings as formulated in Eq. (4).
Liarad
DERT
Bicaoe and
Figure 4. Visualize the tokenization of OPT-I.3B (Zhang et al., 2022), 1aama2-7B (Touvron et al., 2023), NI. (Costa- jussà et al., 2022), and BERT-base (Kenton & Toutanova, 2019) tokenizers. Each single token is indicated with a color block alternatively.
To analyze the applicability of converter C for cross-LLM inference, we visualize the tokenization of 4 tokenizers in Fig. 4, and observe that the tokenizers often decompose sentences similarly. The converter C' processes candidate sequences S(() (for the encoder) and sentence X (for the decoder), which (tt) include the context C(t) and the next token candidate t,, Analysis of the transformation reveals that X and C(²), containing numbers of tokens, can tolerate token variations. The transformed t; can result in three outcomes: 1) merging with the preceding tokens (e.g.. "der" merges with "deco" to form "decoder"); 2) splitting into sub-tokens (e.g., "jointl"" becomes "joint" and "ly"); and 3) remaining unchanged. While the third outcome is ideal, cases and 2 may negatively impact performance of the watermark model.
Table 1. Normalized Levenstein similarity between tokenized sen-
tences across 4 tokenizers.
Tokenizer
OPT-1.3B Llama2-78 NLLB-600M BERT-base
3.6. Cross-LIM Inference
OPT-1.3B
1.000
0.711
0.723
0.838
Llama2-7B
1.000
0.730
0.681
NLLB-600M
1.000
0.721
36 Token 1423 130 50 162
M6 43,
cal
1012
Embaddinga
Embeddinge |0и0
|
Mi Embedding Metris
M, Tokeniow
Mo Takenizor
Mo Embedding Matrs
To estimate the occurrence probability of cases and 2, we quantify the alignment using normalized Levenshtein similarity between token lists for the same sentences across tokenizers, as shown in Table 1. The average token align-
CMM--Ma
Figure 3. Converter for cross-LLM Inference.
5

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
Table Performance of the I.I watermark methods. CI.: Clean watermark sample; SS: Synonymous substitution; CP: Copy-paste
attack; PA: Paragraphing, PPL: text perplexity; Unigrami Unigram vs. Ours; ApiPmat DiPmark vs. Ours; NWM: No watermark.
OPT-1.3B
Llama2-75 -B
Qwen2.5-7B
Method
Robustness (FIT)
Quality
Robustness (FIT)
Quality
Robustness (FIT)
Quality
CL
SS
CP
PA
PPL.
CL
SS
CP
PA
PPL.
CL
SS
CP
PA
PPLJ
NWM
10.484
6.811
8.921
KGW
1.000
0.990
0.983
0,880
13.173
1.000
0.970
0.846
0.858
8.658
1,000
0.983
0.975
0.832
11.419
Unigram
1.000
0.997
0.943
0.943
12.739
0.995
0.990
0.873
0.909
9.275
1.000
0.993
0.955
0.942
10.847
Unbiased
0.992
0.800
0,949
0.680
11.940
0.990
0.785
0.912
0.684
7.565
0.985
0.780
0.930
0.683
10.061
DiPmark
0.997
0.809
0.954
0.692
12.085
0.983
0.779
0,915
0.670
7.681
0.985
0.780
0.923
0.681
10.488
Ours
0.998
0.992
0.975
0.952
12.397
0.995
0,985
0.978
0.916
7.730
0.995
0.985
0.985
0.945
9.997
A Unigram
0%
-1%
+3%
+1%
+3%
0%
0%
+12%
+1%
+17%
-1%
-1%
+3%
0%
+8%
DrpPmark
0%
+23%
+2%
+38%
-3%
+1%
+26%
+7%
+37%
-1%
+1%
+26%
+7%
+39%
+5%
ment probability is 73.4%. We find that given large enough number of candidates k, the converter can be effectively uti- lized for cross-LLM inference! !
4.1.2. METRICS
Following the tradition of Pan al. (2024); Zhang al. (2024), we benchmark LLM watermarking methods across four key aspects: 1) Detection effectiveness of the human- written and clean watermarked text, measured by the FI scores at optimal thresholds; 2) Detection robustness, evalu- ated by subjecting the watermarked text to types of text modifications; 3) Text quality, assessed using the text per- plexity well as performance on downstream tasks in- cluding machine translation and code generation; and 4) Efficiency of the watermarking model, evaluated by measur- ing the time and GPU memory overhead for text generation and watermark detection presented in Appendix E.
4. Experiments
In this section, we present our experimental results. We be- gin with the experimental setup, followed by comparison of watermark detection robustness and text quality against SOTA methods. We then discuss the differences between conventional KGW-type analytical watermarks and the pro- posed neural- -based watermarking approach, followed by the ablation studies.
4.1. Experiment Settings
4.1.3. COMPETITORS
1. IMPLEMENTATION DETAILS
We compare our method with the SOTA logits- meth- ods: KGW (Kirchenbauer al., 2023), SIR (Liu al., 2024b), and Unigram (Zhao et al., 2024), well as distortion-free methods: Unbiased (Hu et al., 2024) and DiPmark (Wu et al., 2024). A comparison involve more competitors is presented in Appendix A.I.
To train our end-to-end model, we choose OPT-1.3B as the online LLM to reduce training cost. We use samples from the WikiText- 103 dataset (Merity et al., 2017) as prompts for training and C4 (Raffel et al., 2020) for evaluation. The context window set to be W 10, with the watermark strength 8 = 1.25 and k 20 for the top-k watermark logits empirically. We employ MGDA (Huo et al., 2024; Désidéri, 2012) to balance the detection and semantic objectives and use the Adam optimizer with a fixed learning rate of le-4 training with 35k steps. All experiments are conducted on one single NVIDIA RTX A6000 48G GPU. The evaluation is performed based on the 2 (Pan al., 2024), open-source tool for benchmarking LLM watermark meth- ods. For further training and evaluation details, please refer to our code and Appendix C.
4.2. Robustness Quality Benchmarking
Table 2 compares the robustness and quality of five methods across three LLMs, with Unigram and DiPmark serving as the strong baselines. The performance gap (A) is presented at the bottom of the table. We use the first 30 tokens from the C4 dataset (Raffel al., 2020) as prompts, and generate 200 clean watermarked tokens watermark sample, with original human-written text serving as non-watermarked samples. Robustness is evaluated under edited conditions (SS, CP, PA in Table 2), while text quality is assessed using PPL with Llama2-133 as the oracle. Unbiased relies on prompts and L.MM API access which constraints absent in our method and other baselines, making it less efficient. No- tably, our model is trained exclusively OPT-1.3B and employs the converter (see Sec. 3.6) for cross-LLM infer-
'Given k = 20, we calculate that the probability of more than half of the candidate tokens being misaligned 0.7% using the binomial distribution.
hntps://gituu..omm/IIi BHIITTTMMMMLMMMLLMMM
6

---

An End-to-End Model for Logits-Based Based Large Language Models Watermarking
(a) Paraphrase
(b) Copy-
Table Performance of method extra LLMs. CL: Clean
sample; SS: Synonymous substitution; CP: Copy-paste attack; PA:
NWM
NWM
Paragraphing; PPL: text perplexity; NWM: No watermark.
14
KGW
14
KEW
Robustness (FIT)
Quality
PPL (Better
12
SR
Unigram
PPL (Better
12
Unigram
SR
LLM
CL
SS
CP
PA
PPLL
10
10
Ours
Ours
NWM
Mixtral-7B
0.990 0.970
0.987
0.916
10.219
8.711
Llama3-88 8B
0.998
0.990
0.990
0.934
7.256
5,964
Llama3.2-38
0.997
0.995
0.993
0,947
7.599
6.301
0.75
0.80
0.8
0.90
0.95
F1 (Better -) 10
F1 (Better
Figure 5. The tradc-off between FI score after text editing and PPL. (a) paraphrasing and (b) copy-paste attack.
Table Downstream tasks performance. The best result is bold, and the second-best is underlined. NWM: No watermark.
Metric
NWM KGW Unigram Unbiased DiPmark Ours Machine translation task with NLLB 8-00
measured by BLEU score, our method achieves the high- est score, 31.062, outperforming the second-best approach (Unbiased, 28.949) by 7.3% and significantly exceeding KGW and Unigram. In CG, evaluated by pass@1 1, our ap- proach attains a competitive score of 34.0, closely trailing the distortion-free methods (DiPmark and Unbiased both 36.0) while surpassing Unigram and KGW. Notably, our approach exhibits exceptional robustness against distortion- free methods while achieving comparable quality, further demonstrating our superiority.
BLEUT 31.789 26.325| 26.057
28.949
28.942
31.062
Code generation task with Starcoder
pass@ 17
43.0
22.0
33,0
36.0
36.0
34.0
ence. Our method outperforms all baselines in robustness and quality across most scenarios, with minor degradations (1-3%) in a few cases, achieving an average F1 score of 0.975 across all scenarios. Our method achieves an aver- age robustness improvement of 17.3% over DiPmark, with notable gains of 37-39% under paraphrasing, while main- taining comparable PPL. scores. Compared to Unigram, our approach shows 1.5% average robustness gain, peaking at 12% under copy-paste attacks for Llama2-7B, and reduces PPL by over 9% on average. These results highlight that our method effectively delivers watermark resilience while pre- serving LLM output quality, making it a practical solution for real-world applications.
The strength parameter 5 in logits- methods is a crit- ical factor in balancing robustness and quality. To system- atically evaluate this trade-off, we conduct experiments assessing watermark resilience against paraphrasing and attack while measuring PPL. Watermarked text is generated under varying 5 values?. The results, pre- sented in Fig. 5, demonstrate the superior performance of our method in achieving an optimal balance between ro- bustness and quality. At a PPL threshold of 8, where the non watermarked baseline has a PPL of 6.8, our approach improves robustness by 18.16% under paraphrasing and 20.42% under copy-paste edits, surpassing the second-best method, Unigarm. In contrast, existing approaches such as KGW, Unigram, and SIR exhibit significant text qual- ity degradation, with PPL values increasing by two to three times compared to the default 5 while offering only marginal robustness improvements. These results highlight the ef- fectiveness of our method in preserving text quality while achieving substantial robustness against text modifications.
the
To further validate the LLM-agnostic generalizability of our method, we conduct experiments on three additional LLMs, with the results shown in Table 3. Our approach consistently achieves a high Fl score (2 0.99) on clean watermarked samples across all LLMs, demonstrating its stability and reliability. Moreover, it maintains strong ro- bustness against all editing types, yielding an average F1 score of 0.969. In terms of text quality, our method in- troduce only a moderate increase in PPL, approximately 1.2x that of non-wakermdrked baselines. These zero-shot results highlight the effectiveness of our approach without necessitating L.LM-specffic tuning, underscoring its broad applicability across diverse LLM architectures.
Additional quantitative results are presented in Appendix A.
4.3. Comparsion to KGW-type Methods
As shown in Table 4, we evaluate the impact of watermark- ing on downstream applications including machine trans- lation (MT) and code generation (CG). Specifically, we assess translation performance using the WMT16 German- English benchmark with WTLB-600M, and code generation using the HumanEyal benchmark with Starcoder. For MT,
We justify our proposed neural-based method by comparing to the KGW-type approaches, highlighting that our method offers guarantees analogous to provable p- p-values, which are
Eaah method is tested at its default strength, as well as one lower and one higher setting: KGW and Unigram: {1, (0.5, 1, 2); Ours: (0.75, 1.25, 1.5)
2, 5); SIR:
7

---

An End-to-End Model for Bogits-Based Large Language Models Watermarking
(a) LLama2
(b) Qwwen2.6
that enhance detection performance. The detection perfor- mance of our statistical and neural decoder is presented in the Appendix B.2.
2.00
1.00 20200)
False Positive Thresholding. Our model uses neural decoder to generate a scalar confidence score for watermark detection. Similar to KGW-type methods, both employ a fixed threshold to detect watermarks, enabling adjustments to control false positive rates. Fig. 7 shows ROC curves under various text modifications, demonstrating the model's ability to manage false positive rates effectively. FPR across more LLMs is shown in Appendix A.5.
0.50
0.50
Milamuttdd Lmwwttaare
0.00
40 Curcutoive Watermank Loghs
60
120
Carulattve Note mark Log t
Statistical Deooder F1:0,995 999
Statistical Decoder F1: 0,982
Neural Decoder F1:0.995
Neural Desoder #1: 0.556
Figure 6. Correlation between the cumulative perturbed logits and the neural decoder logits of (a) Llama2-7B and (b) Qwen2.5-7B watermark samples.
4.4. Ablation study
Table S. Effect on different settings of our method. CL: Clean watermark sample; CP: Copy-paste attack; PA: Paragraphing: PPL: text perplexity; LD: log diversity.
(8) Paraphrase
(b) Copy-paste
Tun Nosttve Rate
0.8
0.8
Llama2-7B
0.6
0.6
Robustness
Quality
Setting
KGW: AUC.0.90
KGW: AUC:0.99
CL
PA
CP
PPL.
LD1
0.4-
Unigrem: AUC:0.95 95
0.4
Unigram: AUC:0.94
w/o Lxem
0.995
0.960
0.982
9.561
8.165
0.2
SIR; AUC:0.97
Ours: AUC:0.97
0.2
SIR: AUC:0.85
Ours; AUC:1.00
w/o N
0.992
0.867
0.952
7.820
7.788
0.00
1.0
0.000
1.
8=.75, k=
0.960
0.854
0.958
7.057
7.694
Positive Rate
Positive Rate
8=.75, k=40
0.957
0.832
0.957
7.278
8.253
Figure 7. ROC curves for watermark detection under (a) paraphras- ing and (b) copy-paste attack.
8=1., k=00
0,983
0.898
0,980
7,518
8,016
8=1., k=40
0.980
0,884
0.978
7.981
7.995
8=1.25, k=40
0.992
0,931
0.983
8.346
8.003
8=1.5, k=20
0.995
0.962
0.992
8.566
7.771
8=1.25, k=20
0.995
0.916
0.978
7.730
7.594
essential for text forensics.
Red-Green List Retrieval. Although our method does not explicitly rely on the p-value to determine the presence of the watermark, we allow for forensic analysis by retrieving the logits perturbation, which serves as the counterpart to the red-green list in KGW, for each token in given sen- tence. Specifically, given input sequence [xI...., X.]] tokenization is performed using the proposed converter. The retrieval is achieved by first obtaining the output distribu- tion of M at each step for [xw:.... xn] and subsequently reconstructing ((9)= for each step t. The logits perturbation top ). Our wa- termarked samples colored with retrieval logits perturbation are visualized in Appendix I, this retrieval process enables the classification of tokens into green and red lists, thereby enhancing the interpretability of our watermark signal.
The ablation study in Table 5 evaluates the impact of key components and hyperparameters on model performance. Removing the semantic loss Zuem degrades text quality, in- creasing PPL by 23.6% while retaining strong robustness. Disabling the online editor N significantly weakens resis- tance to text edits, with F1 scores dropping by 5.7% for paraphrasing and 2.7% for the copy-paste attack. Our model enables users to balance quality metrics flexibly by adjusting the top-k logits tokens without retraining. Increasing & from 20 to 40 enhances log diversity but results in a slight increase in perplexity. Adjusting 8 reveals a clear trade-off between robustness and text quality. Lowering 8 to 0.75 reduces Fl scores for paraphrasing to 0.854 but achieves the lowest PPL at 7.057. Conversely, increasing 8 improves robustness, with F1 scores peaking at 0.962 for paraphrasing and 0.992 for the copy-paste attack at 5 = 1.5, though at the cost of higher PPL, a 21.3% increase compared to = 0.75. The optimal balance is achieved 8 1.25, where Fl scores for paraphrasing remain high at 0.916 while maintaining a moderate PPL of 7.730.
then sequentially derived as (() k = F(((())
Statistical Decoder vs. Neural Decoder. Our method en- ables the retrieval of logits perturbation for a given sentence, allowing us to visualize the relationship between cumulative perturbed logits and neural decoder logits in Fig. 6. The analysis shows a strong positive correlation, where neu- ral decoder logits increase as cumulative perturbed logits rise across the two LLMs. Additionally, the neural decoder outperforms the statistical decoder, likely due to the joint op- timization process, which allows to capture latent features
5. Conclusion
We introduce a novel logits based end-to-end model, where encoder and decoder networks are jointly optimized to im-
8

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
prove detection robustness and text quality. We overcome the non-differentiability of the online text editor and mantic loss computation by using novel prommpiig technique that leverages the on-the-fly LLM as differen- tiable surrogate. Our method can be easily generalized to different LLMs.
Choi, J., Chowdhury, A. R., Christodorescu, M., Datta, A., Feizi, S., et al. Identifying and mitigating the security risks of generative ai. Found. Trends Privacy Secur, 2023.
Bengio, Y., Louradour, J., Collobert, R., and Weston, J. Curriculum learning. In Proc. Int. Conf. Mach. Learn., pp. 41-48, 2009.
Acknowledgements
Christ, M., Gunn, S., and Zamir, O. Undetectable water- marks for language models. In Proc. Annu. Conf. Learn. Theory, 2024.
This work was supported in part by Macau Science and Technology Development Fund under SKIIOTSC-2021- 2023, 0022/2022/A1, and 01 0199/224// in part by Re- search Committee at University of Macau under MYRG- S01023-00008--SS-UMDDD
Costa-jussà, M. R., Cross, J., Çelebi. O., Elbayad, M., Heafilld K., Heffernan, K., Kalbassi, E., Lam, J., Licht, D., Maillard, J., et al. No language left behind: Scal- ing human-centered machine translation. arXiv preprint TrXiv:2207.04672, 2022.
part by the Guangdong Basic and Applied Basic Research Foundation under Grant 2024A1515012536.
Impact Statement
Désidéri, J.-A. Kultiple-gradien descent algorithm (mgda) for multiobjective optimization. Comptes Rendus Mathe- matique, 2012.
Embedding resilient watermarks in Al-generated text trans- forms how we govern and trust automated content. Plat- forms can reliably verify authorship, deterring plagiarism and malicious reuse, while publishers gain confidence in sourcing and provenance. Content consumers benefit from clearer attribution, reducing the spread of misinformation. Regulators and standard-setting bodies acquire practical tools to enforce intellectual-proyt property rights and audit gener- ative systems. By elevating accountability and transparency across the AI ecosystem, the proposed watermark method approach paves the way for responsible innovation, bol- sters public trust, and safeguards creative and journalistic integrity.
Devlin, J. Bert: Pre-training of deep bidirectional trans- formers for language understanding. arXiv preprint DXXiv:810000800, 2018.
Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21756 2024.
Hendy, A., Abdelrehim, M., Sharaf, A., Raunak, V., Gabr, M., Matsushita, H., Kim, Y. J., Afify, M., and Awadalla, H. H. How good are gpt models at machine trans- lation? a comprehensive evaluation. arXiv preprint ar arXhv:2302.09210, 2023.
References
Abdelnabi, S. and Fritz, M. Adversarial watermarking trans- former: Towards tracing text provenance with data hiding. In IEEE Symp. Secur. Privacy, 2021.
Hu, Z., Chen, L.., Wu, X., Wu, Y., Zhang, H., and Huang, H. Unbiased watermark for large language models. In Proc. Int. Conf. Mach. Learn., 2024.
Achiam, J., Adler, S., Agarwal. S., Ahmad, L., Akkaya, I,, Aleman, F. L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774. 2023.
Huo, M., Somayajula, S. A., Liang, Y., Zhang, R., Koushan- far, F., and Xie, P. Token-specific watermarking with enhanced detectability and semantic coherence for large language models. In Proc. Mach. Learn. Res., 2024.
Augenstein, I., Baldwin, T., Cha, M., Chakraborty, T., Ciampaglia, G. L., Corney, D., DiResta, R., Ferrara, E., Hale, S., Halevy, A., et al. Factuality challenges in the era of large language models and opportunities for fact- checking. Nature Mach. Intell., 2024.
Jang, F., Gu, S., and Poole, B. Categorical reparameteri- zation with gumbel-softmax. In Proc. Int. Conf. Learn. Representat., 2017.
Jawahar, G., Abdul- Mageed, M., and Lakshmanan. L. V. Automatic detection of machine generated text: A critical survey. In Proc. Int. Conf. Comput. Linguistics, 2020.
Bakhtin, A., Gross, S., Ott, M., Deng, Y., Ranzato, M., and Szlam, A. Real or fake? learning to discriminate machine from human generated text. arXiv preprint 1xXi:19900.035/11 2019.
Jiang, T., Huang, S., Luan, Z., Wang, D., and Zhuang, F. Scaling sentence embeddings with large language models. arXiv preprint 2.0i:2377.16644 2023.
Barrett, C., Boyd, B., Bursztein, E., Carlini, N., Chen, B.,

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
Jovanović, N., Staab, R., and Vechev, M. Watermark steal- ing in large language models. In Proc. Int. Conf. Mach. Learn., 2024.
Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W. and Liu, P. J. Exploring the limits of transfer learning with unified text-to-text transformer. J. Mach. Learn. Res., 2020.
Kenton, J.
D. M.-W. C. and Toutanova, L. K. Bert: Pre- training of deep bidirectional transformers for language understanding. In Proc. North American Chapter Assoc.
Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al. Llama 2: Open foundation and fine- tuned chat models. arXiv preprint arXiv:2307.09288 2023.
Comput. Linguistics, 2019.
Kirchenbauer, J., Geiping. J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. A watermark for large language models. In Proc. Int. Conf. Mach. Learn., 2023.
Wu, Y., Hu, Z., Guo, J., Zhang, H., and Huang, H. A resilient and accessible distribution-preses preserving watermark for large language models. In Proc. Int. Conf. Mach. Learn., 2024.
Kirchenbauer, J.. Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., and Goldstein, T. On the reliability of watermarks for large language models. In Proc. Int. Conf. Learn. Representat. 2024.
Zhang, R., Hussain, S. S., Neekhara, and Koushanfar, F. (REMARK-LLM)) A robust and efficient watermark- ing framework for generative large language models. In USENIX Secur. Symp., 2024.
Krishna, K., Song, Y., Karpinska, M., Wieting, J., and lyyer, M. Paraphrasing evades detectors of ai-generated text, but retrieval an effective defense. In Proc. Ady. Neurul Inf. Process. Syst., 2023.
Zhang, S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C., Diab, M., Li, X., Lin, X. V., et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.0100 2022.
Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, Robust distortion-free watermarks for language models. Trans. Mach. Learn. Res., 2024.
Zhao, X., Ananth, P., Li, L., and Wang, Y.-. Provable robust watermarking for ai-generated text. In Proc. Int. Conf. Learn. Representat., 2024.
Lee, T., Hong, S., Ahn, J., Hong, I., Lee, H., Yun, S., Shin, J., and Kim, Who wrote this code? watermarking for code generation. In Annu. Conf. Robot Learn., 2023.
Liu, A., Pan, L., Hu, X., Li, S., Wen, L., King, I., and Philip, S. Y. An unforgeable publicly verifiable watermark for large language models. In Proc. Int. Conf. Learn. Repre- sentat., 2024a.
Liu, A., Pan, L., Hu, X., Meng. S., and Wen, L. A semantic invariant robust watermark for large language models. In Proc. Int. Conf. Learn. Represental,, 2024b.
Merity, S., Xiong, C., Bradbury, J., and Socher, R. Pointer sentinel mixture models. In Proc. Int. Conf. Learn. Rep- resentat., 2017.
Mitchell, E., Lee, Y., Khazatsky, A., Manning, C. D., and Finn, C. Detectgpt: Zero-shot machine- machine-generater text detection using probability curvature. In Proc. Int. Conf. Mach. Learn., 2023.
Ni, A., Iyer, S., Radev, D., Stoyanov, V., Yih, W.-L, Wang, S., and Lin, X. V. Lever: Learning to verify language-to- code generation with execution. In Proc. Int. Conf. Mach. Learn., 2023.
Pan, L., Liu, A., He, Z., Gao, Z., Zhao, X., Lu, Y., Zhou, B., Liu, S., Hu, X., Wen, L., et al. Markllm: An open- source toolkit for IIm watermarking. arXiv preprint arXiv:2405. 10051, 2024.
10

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
Appendix
Contents
A More Quantitative Results
12
A.1 More Competitors
12
A.2 Effect on Sentence Length
12
A.3 Effect on LLM Temperature
13
A.4 Effect LLM Sampling Strategy
13
A.5 False Positive Rate Clean Watermark Sentence
14
A.6 Statistically Significant Improvement...
14
Watermark Analysis
15
B.1 Watermark Sample
15
B.2 Source of Robustness
15
B.3 Risk of Watermark Theft
16
B.4 of the Red-Green Split
17
B.5 Token Distribution Bias
17
Training and Evaluation Details
18
C.1 Model Training Details
18
C,2 Training Stability
18
C.3 Editing Configuration
19
C.4 Examples of online text modification
19
D Comparison with Post-Generation Watermarking Methods
21
Watermark Efficiency
21

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
A. More Quantitative Results
A.I. More Competitors
Table Overall performance of the LLM watermark methods. CL: Clean watermark sample; SS: Synonymous substitution; CP: Copy- paste attack; PA: Paragraphing. Detection Performance is evaluated on Llama2-7B. PPL: Text perplexity with Liama2-13B, MT: Machine translation with NLLB-6000 CG: Code generation with Starcoder. The best in bold, and the second-best underlined.
FIt
PPL1
BLEU
pass 11
Method
CL
SS
CP
PA
Avg.
Qit
MT
CG
KGW (d=2)
1.000
0.980
0.824
0.878
0.920
8.658
26.325
22.0
Unigram (Ó=2)
0.997
0.985
0.864
0.885
0.933
9.275
26.057
33.0
SWEET (6=2)
0.997
0.959
0.952
0.817
0.931
8.522
27.916
36.0
SIR (d=1)
0.982
0.945
0.810
0.879
0.904
8.566
27.557
30.0
TSW
1.000
0.964
0.913
0.849
0.932
8.466
28.355
32.0
Unbiased
0.990
0.785
0.912
0.684
0.843
7.565
28.949
36.0
DiPmark
0.983
0.779
0.915
0.670
0.837
7.681
28.942
36.0
Ours (6=1.25, k=20)
0.995
0.985
0.978
0.916
0.969
7.730
31.062
34.0
We compare our method with extra three regits-based methods: SWEET (Lee et al., 2023). SIR (Liu et al., 2024b), and TSW (Huo al., 2024). Table presents the detection performance and text quality across different watermark methods. In terms of robustness, our method outperforms all competitors, achieving the highest average F1 score of 0.969, surpassing the second-best method, Unigram by 3.9%. Our method demonstrates exceptional resilience against the copy-paste and paraphrasing attacks, achieving 0.978 and 0.916. respectively, outperforming the strongest baseline (Unigram) in each cases by 13.2% and 3.5%. Furthermore, our method achieves the highest BLEU score of 31.062, exceeding the next-best approach (Unbiased, 28. (4,9 by 7.3%, and attains a competitive pass@) @ score of 34.0, outperforming Unigram by 3.0%. In contrast, methods (such as KGW and Unigram) exhibit strong robustness generally cost of increased PPL (8.658 and 9.275, respectively), whereas our method maintains a lower PPL pf 7.730, improving output quality by 16.7% compared Unigram. These results highlight the effectiveness of our approach achieving superior watermark robustness while preserving high text quality across diverse tasks.
A.2. Effect on Sentence Length
OPT-1.3B
Llama-778
Qwen2.5-76
1.00
0.95
0.90
0.85
0.80
0.75
50
100
150
200
0
50
100
150
200
50
100
150
200
Sentence Length
Sentence Length
Sentence Length
KGW
Unigram
Unbiased
DiPmark
Ours
Figure 8, Detection performance (F11) watermark sentences with various length.
Fig. 8 presents the F1 score of various watermarking methods across different sentence lengths for three LLMs: OPT-1.3B. Ilama2-7B, and Qwen2.5-7B. The results demonstrate that across all methods, F1 scores generally improve as sentence length increases, indicating enhanced watermark detectability in longer text. Our method consistently achieves strong performance across all models and sentence lengths. Notably, for shorter sentences (length < 50), our method attains higher Fl scores compared to other baselines, specially with an average improvement of 8% over DiPmark and Unbiased. For longer sentences (length 2 100), all methods converge toward near-optimal F1 scores (= 1.00).
12

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
(a) Clean
(b) Synonymous substitution
(c) Copy-paste
(d) Paraphrase
(e) Average
1.0
1.0
0.9
0.9
0.9
0.9
0.9
KGW
0.641
Unigram
Unbiased
0.7
DiPmark
0.7
0.7
0.7
0.7
Ours
1.0
0.8
0.6
0.4
1.0
0.8
0.6
0.4
1.0
0.8
0.6
0.4
0.6
1.0
0.8
0.6
0.4
0.6
KBW
Unigram
Unblaced
Dommank Ours
LLM Temperature
LLM Temperature
LLM Temperature
LLM Temperature
Figure 9. Detection performance (FI on various L.M temperatures.
A.3. Effect on LLM Temperature
Fig. 9 presents the Fl scores of different watermark methods across various LLM temperatures under clean and edited conditions, including synonymous substitution, copy-paste attack, and paraphrasing. The rightmost subfigure (e) reports the average Fl score across all conditions, highlighting overall robustness. Our method consistently outperforms all baselines, achieving an average F1 score of 0.976, which surpasses KGW and Unigram (both 0.930) by 4.9% and significantly outperforms Unbiased (0.841) and DiPmark (0.832) by 16.1% and 17.3%, respectively. Under clean conditions (a), all methods perform well, but our approach maintains slight edge in stability across different temperatures. In synonymous substitution (b) and the copy-paste attack (c), our method demonstrates superior robustness, maintaining F1 scores near 1.0 while competing approaches experience noticeable declines. For paraphrasing (d), where detection is most challenging, our method exhibits a substantial advantage, outperforming the strongest baseline by over 7%. Lowering the temperature makes the LLM more deterministic, increasing the likelihood of sampling high-logit tokens. Since our model perturbs the top-logits, a lower temperature favors selecting tokens from our red/green lists over those the grey list (see Section 3.2), thereby improving performance.
A.4. Effect on LLM Sampling Strategy
Table 7. Detection performance (FI1) of the LLM watermark methods with multinomial sampling and beam search. CL: Clean watermark sample; SS: Synonymous substitution; CP: Copy-paste attack; PA; Paragraphing. Detection Performance is evaluated on Llama2-7B. The best is in bold, and the second-best is underlined.
Multinomial sampling
Beam search (num bcams=5)
Method
CL
SS
PA
CP
CL
SS
PA
CP
KGW (0=2)
1.000
0.980
0.878
0.824
1.000
0.998
0.940
0.975
Unigram (d=2)
0.997
0.985
0.885
0.864
1.000
1.000
0.954
0.939
SIR (5=1)
0.982
0.945
0.879
0.810
0.992
0.977
0.912
0.790
Ours (8=1.25, k=20)
0.997
0.985
0.916
0.978
0.997
0.995
0.962
0.995
Table presents the performance of different watermarking methods under multinomial sampling and beam search (num beams = 5). Our method achieves the best overall performance, demonstrating superior robustness in most scenarios. Under multinomial sampling, it outperform all baselines PA and CP, achieving Fl scores of 0.916 and 0.978, respectively, which are 3.5% and 13.2% higher than the second- best method (Unigram). For beam search, our method maintains strong robustness, achieving the highest Fl scores for PA (0.962) and CP (0.995), surpassing KGW by 2.3% and 2.1% respectively. In contrast, while KGW and Unigram perform well under clean conditions (CL), with both achieving Fl scores of 1.000, they lag behind our method in edited scenarios. For instance, under CP with multinomial sampling, our method improves robustness by 13.5% compared to KGW. These results highlight the effectiveness of our approach in handling both clean and challenging text modifications, achieving robust balance between accuracy and consistency.
13

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
Table Best Fl FPR clean watermark samples.
LLM
Best F1 FPR.
OPT-1.3B
0.00
Llama2-7B
0.03
Qwen2.5-7B
0.01
Mistral-7h
0.01
Llama3-8B
0.01
Llama3.2-30
0.01
Avg.
0.01
A.5. False Positive Rate on Clean Watermark Sentence
present the best Fl FPR for various LLMs of our method in Table Notably, OPT-1.3B achieves an FPR of 0.00, Llama2-7B is at 0.03, and all other models (Qwen2.5--7, Mistral-7B, Llama3-8B. and Llama3.2-3B) consistently achieve an FPR of 0.01. With average FPR of just 0.01, our method demonstrates exceptionally low false positive rates across different LLMs.
A.6. Statistically Significant Improvement
Table Paired I-test results comparing model with competitors. Detection Performance is evaluated Llama2-7B. PPL:: Text perplexity with Llama2-13B. Mean Diff. represents the difference between our model and each competitor's 's' mean performance. All p-values below 0.05 indicate statistically significant improvements.
Method
PA(FIf)-Trials
Mean + Std
Mean Diff.
p-value
KGW (b=2)
0.818
0.798
0.844
0.828
0.835
0.824 # 0.018
0.087
2.12 x 10
Unigram (6=2)
0.910
0.899
0.892
0.906
0.882
0.898 + 0.011
0.014
3.80 x 10-2
Ours (0=1.25, k=2
0.918
0.908
0.909
0.906
0.917
0.912 + 0.005
Method
CP(F11)-Triat)
Mean Std
Mean Diff.
p-value
KGW (8=2)
0.843
0.832
0.845
0.847
0.839
0.841 + 0.006
0.119
5.51 10
Unigram (6=2)
0.864
0.900
0.859
0.861
0.866
0.870 = 0.017
0.091
3.23 10-4
Ours (6=1.25, 2==20)
0.968
0.960
0.964
0.967
0.942
0.960 = 0.011
Method
PPI.L-Trrills
Mean Std
Mean Diff.
p-value
KGW (8=2)
8.656
8.678
8.800
8.730
8.409
8.655 = 0.148
-1.014
1.07 10-4
Unigram (8=2)
8.871
8.832
8.918
9.155
9.092
8.973 = 0.142
-1.333
3.82 x 10-1
Ours (5=1.25, 2==
7.626
7.620
7.544
7.773
7.642
7.641 = 0.083
To validate the statistical significance of our model's improvements, we conducted robustness and quality experiments using a paired t-test in Table 9. Specifically, we performed five trials to evaluate robustness against paraphrasing (PP) and copy-paste (CP) attacks, as well as the perplexity (PPL) of watermarked text. All trials were conducted using the same set of prompts, with multinomial sampling (same seed across methods in the same trial for consistency). resulting in diverse outcomes across the five trials. The watermark strength parameters (6) for KGW, Unigram, and our method were set to 2, and 1.25, respectively, while the k-value for our method was 20. The results, shown in Table 9, indicate that our model achieves statistically significant improvements in both robustness and quality compared to the competitors. This is supported by p-values consistently below the 0.05 threshold.
14

---

An End-to-End Model for Bogits-Based Large Language Models Watermarking
B. Watermark Analysis
B.I. Watermark Sample
Teo tHE ordecs for militery ballorptera and guided bosto copped cometieble procurvment waich the Intretes becans the Lacpert teceige of dacaron officiale the deals muck bi12ion. aigued Deoodiee bat decalle made belácop
NWM-sen1
sigted
spacta
plasse lelloggter These expped militery salen iepertoo deserilent
top
final leed
Tho VAA ordace for military tallergtars and guided bosbe capped a comercable your for procommnnt in shich the intrates becane the lucpert foceign pesclasne of to daderon ecuipponnt HiSh an under list tas Lacledee 12. aillion soder toe F- L6 rigitee jets and i. 100 other us made alliee eiittire.... Shahd bey part Prestdent Bernek Chenn rob kade the Cold state is see of hip iepectart in remae. D0 U steataglc nalitary partoecebsp long- and
WM-sen1
anch alller
jermeys
2007. oplas item her rsence Roday Den ntagtee ( rsbons Steop spece by Techel Coen idka Das tee "Weldd 'a Flest Deper nedal Dickinane and her then of have ualled ocd thise vodking. in scaceseac to bage dis. the 18- your old coaliny 2V atau woute "A lecoed on making Husky the neee Loved and havey in she vhele world fer the sean as years the former expple had been teeether for 11 years and had bees ceppged for sen aot tie kese this Oudge aboo. wil tay Rick: aattle deive nick
incmnd make Roddy happitet man in the for
medel maid Jae iom
NWM-sen2
tarch... singtos
by teede bad appeazed spilt fallove
2023 oplande of the toeme "kerrics 's Hoxt 2op lodel"
Beakl hnappoen
Reshivvl 2018 aot
her than ob.
Brickiasnn to wen gen hit
spchoopecnon the reper mode!
coatisaed to 220054 that the bloeds will manxy has Elance of con yess 32 year oid fiin and TV poodscss lobect aatt eepeaseccative for fill and noneationn alsu suld
WM-senZ
tax that the pais will marky in the onar fatuir. tisk insus in any alee told pddlicationn that the beiie to be io the illed to get the merziage undeeway
inteed to take cace of ber for the rest for ber life 1 cert en sald in intercioe..... vayy good bet to also vacy vary cauglty and gaeea abow
kenp
ruening
agenctes to not mony step Prartsoniny to opezate but aoe going to have zeabes Lazzas to with sold Thii program in intecrion that sized in Fceday dels ceiling, shith guomms
egreenenn
goverrmest
NWM-sen3
neeey the fnderal quees smeeLt allived to batrese Also ast to ba reasled thareday
Denecrette teeator Chock Schemer. the chenter by So. Temecrst toid CBS Pace the Notooe peogrem that Lewnsbers coeld avert cebt cesoss if bepablloans vould sgres to raise the beesondng cap by as least $1 tesillon. our pocition in pestty stmple
goliticsi
they
WM-sen3
speesting not optinistic that the Congrass in coady make the trugh desinions have make get spending conteol the
8318 teillien Indernt willing
polt Pressdent Bernch
talllioss da national dade that JeaS wnt asable mactomy and oome the Zang fas netioeal well bming and one stardted of Sawingg tew saad
so staus to coliee pasilem
Figure 10. Visualizing three pairs of sentences comparing outputs from the original L.M (NWM) and the watermarked text (WM) of our method using the same prompt. Prompts are highlighted in gold, tokens are colored by the output values of the watermark encoder, and tokens outside the top-k logits are shown in grey.
Fig. 10 presents three pairs of non-watermarked and watermarked samples generated from the same prompt of our method. The tokens are colored based on the output values retrieved from the watermark encoder. The watermarked samples maintain high quality while featuring a greater proportion of green-list list tokens compared to red-list tokens. The ratios between NWM/WM texts are not similar all, the NWM texts have red/green token counts of 69:53, 61:65, and 74:75 (ratios 1.30, 0.94, and 0.99). In contrast, the WM texts show counts of 42:83, 50:99, and 53:79 (ratios 0.51, 0.51, and 0.67). This is achieved by increasing the probabilities of green-list tokens during the generation process.
B.2. Source of Robustness
We argue that robustness arises from two factors:
1. Watermark Decoder: By retrieving the red-green token lists with our watermark encoder (see Sec. 4.3), we can statistically compute token ratios that provide guarantees similar to provable p-values (analogous to KGW), which is critical for text forensies. As shown in Table 10, although our neural with a noise
benefitinnn from end-to-end optimization outperforms the statistical decoder, the latter remains competitive with strong baselines. At fixed 1% FPR, the statistical decoder achieves a TPR of 0.96 in CP and TPR of 0.65 in PA, compared to KGW's 0.81 (CP) and 0.50 (PA) as well as Unigram's 's 0.56 (CP) and 0.61 (PA). Since statistical decoder based solely on the red/green partition, and our neural decoder outperformed the statistical one, demonstrating that end-to-ent training with a noise layer enhances robustness.
2. Red/Green Partition: We measure the KL divergence (KLD) between token distributions of watermark (WM) and non- non-watermark (NWM) sentences (see Fig. 11) to evaluate the context independence (CI) of our partition. purely CI
15

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
Table 10. Detection performance of neural decoder and statistical decoder.
1%FPR
TPR1
Best FIf
Method
CL
SS
CP
PA
CL.
SS
CP
PA
KGW (6= 2)
1.00
0.94
0,81
0.50
1.00
0.96
0.92
0.82
Unigram (6 2)
1.00
0.98
0.56
0.61
1.00
0.98
0.85
0.92
Ours (Neural Decoder, 5 1.25, k: 20)
0.99
0.96
0.96
0.75
1.00
0.98
0.97
0.92
Ours (Statistical Decoder, 8 1.25, k 20)
0.95
0.91
0.96
0.65
0.97
0.96
0.97
0.85
partition (e.g., Unigram) shows high KLD due token biases, while our method achieves KLD of of Unigram's 0.21 and above KGW's 0.03 0.03-indicating balance between context-dependent (CD) and CI schemes. Our ablation study on context size after paraphrasing is shown in Table 11. Our adaptive partition lets the encoder use strong CD features when available and fall back to CI approach when necessary, which is crucial for our robustmess.
half
Table 11.
Detection Performance under different context size.
Context Size
1%FPR TPR (PA)
2
0.69
4
0.76
8
0.79
10
0.80
B.3. Risk of Watermark Theft
Acquisition of Different Watermarks. It is NOT necessary to retrain the entire network from scratch for each user-specific watermark. The proposed end-to-end framework is flexible enough to inject key-driven randomness at multiple stages (input, model parameters, or output). practice, one can fine-tune (FT) and apply key-conditioned post-processing without retraining, Different watermarks can be guaranteed by incorporating key-driven bias logit 1B 1-1, (of vocabulary size) into the final watermark logits via i = + 8 (lw + IB), which Ig is only applied to the top-k logits. Since 1g is derived from a unique key, statistical analysis demonstrates that each item in the clipped output remains unchanged with probability 0.5 and changes with probability 0.5 (assuming each i item, 1 ~ Uniform(1 (1,, 1)), 1 Uniform(f-1, and all items are independent). The number mismatches between watermarks generated using different keys follows a binomial distribution (k, 0.5), implying that the probability of obtaining identical watermarks is negligibly small. E.g.
20, the probability identical watermark is 0.520 9.54 10-7
Table 12. I&FPR TPR, of watermark theft on datasets Dolly CW and MMW BookReports.
Method
Dolly CW
MMW BookReports
KGW
0.45
0.59
KGW (Diff. key)
0.10
0.16
Unigram
0.22
0.04
Unigram (Diff. key)
0.11
0.15
Ours (CD score)
0.13
0.16
Ours (CI score)
0.55
0.56
Ours (CI score, FT w/ Lg 5k steps)
0.19
0.12
We conduct a spoof attack (Jovanović et al., 2024) with 2,000 queries method to evaluate resistance against watermank theft (lower TPR is better) in Table 12. Our method is more vulnerable with CI scoring (0.55 and 0.56 for the two datasets), but FT w/ reduces the TPR to 0.19 and 0.12, which is comparable to using different keys in KGW and Unigram.
Meanwhile, as shown in Table 13, our FT model shows performance comparable to the original checkpoint. Notably, the PPL. improves from 7.73 to 7.28 but the TPR drops from 0.75 to 0.53 the PA case.
16

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
Table 13. Overall performance of our finetune model with logtis bias.
1%FPR
TPR1
PPL.
BLEUt
pass 1
Method
CL
SS
CP
PA
Qit
MT
CG
Ours
0.99
0.97
0.98
0.75
7.73
31.06
34.00
Ours (FT)
1.00
0.98
0.99
0.53
7.28
30.94
32.00
B.4. of the Red-Green Split
Table 14. Statistics of y on diffcrent corpus.
Hugging Face Dataset
Mean Std
xsum
0.38 + 0.11
0.43 = 0.11
ML-ArXiv-Papers
0.40 = 0.13
mimic-cxr-datasee
0.40 = 0.12
finance-alpace
0.41 = 0.11
Different from KGW, the ratio of green tokens in the red-green partition y is not deterministic, but train by the watermark encoder, which could be vary with different context. We show the statistics of y in Table 14, and find that our method achieves average y of 0.4 across datasets with diverse topics.
B.5. Token Distribution Bias
Takan Distribution
Taken Disttr isttonbttioon
Tokon Distribution
300
Non watermarked
Non Son-watermmereed Watermaried
Nen-wstermarked Vetermarked
Watermar at kad
Frequency
Frequency
Fecouency
Taken
(a) KoW(B= 2): 0.030
[b) Unigram(8 2); KL: 0.211
(c) SIR(8 1); KL: 0.137
Toieen: Distributtion
"ooker Distr bunion
Non-watermarked
17c
Non-watermarked
Wal enmark bad
Watermarized
Froquency
Frequency
Taken
Toklen
(d) Ours(5 = 1.25, 20); KL: 0.122
(e) Ours(5 0.75, k= 20); KL: 0.066
Figure 11. Token distribution and KD divergence (lower the better) between non-waatermakk/vateemnak sentences of method in different settings as well as the SOTA competitors.
We further examine the effect of watermark strength 5 on token distribution, as depicted in Fig. 11. With the default setting of 8 = 1.25, our model introduces less token bias compared to Unigram and SIR, while achieving superior robustness, as shown in Table 6. However, although our method outperforms KGW in robustness, it introduces a greater token bias. We argue that this highlights an inherent trade-off between robustness and token bias. Reducing to 0.75 reduces the KL divergence by 50% compared to the default setting, but comes the expense of reduced robustness.
17

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
C. Training and Evaluation Details
C.I. Model Training Details
Table 15. Hyperparameters of the end-to-end model training.
Item
Value
Learning rate
le-4
Batch size
8
Training step
35k
Encoder context size
10
On-the-fly LLM
OPT-1 1 1.3B
Top-k candidate
20
Prompt tokens
30
Gumbel-softmax temperature Tg
0.1
Probability of activating N
0.5
Sharpness of lanh, 7
1000
Maximum generated tokens
100
Watermark strength ò
1
Weight of Ldee
10
Weight of Cyem
1
We trained our end-to-end model on single NVIDIA RTX A6000 48GB GPU for 35k steps, completing the training in approximately 5 days with a GPU memory usage of 21. 16G... The hyperparameters used during training are detailed in Table 15. If GPU memory is limited, the batch size and maximum generated tokens can be reduced, or a smaller LLM, such as OPT-125M, can be used. While the training phase takes longer compared to existing training- training-based models like SIR, UPV, and TSW, this is due to the introduction of the entire LLM (with frozen parameters) in the training process. Despite the longer training time, we developed an efficient converter for cross-LLM inference, ensuring that the computational cost during inference remains low.
Differentiability. It is important to clarify that all prompts and generated text remain in the embedding domain throughout the training process. our proposed online prompting, the prompt is first converted into the embedding domain and then concatenated with Xwm or X This ensures the entire process differentiable, as we avoid the text-embedding transformation, which is the primary source of aon-differentiabiityy.
Training Strategy. To ensure stability and promote convergence in end-to-end model, adapt two training strategies: the Gradinte Descent Algorithm (Huo et al., 2024; Désidéri, 2012) and Curriculum Learning (Bengio et al., 2009).
1. Multiple-Gradient Descent Algorithm. The detection loss Lae and the semantic loss S-em are inherently conflicting: reducing one often increases the other (Huo et al., 2024). We apply MGDA to resolve this multi-objective optimization, which is proven to converge to Pareto stationary solution (Désidéri, 2012).
2. Curriculum Learning. Training is divided into three progressive stages move from easy to hard:
Stage I (< 10k steps): optimize only the detection objective.
Stage 2 (10k-201 20k steps): optimize both detection and semantic objectives jointly.
Stage 3 (> 20k steps): activate the noise layer for online paraphrasing together with the two objectives.
This curriculum schedule enhances training stability and accelerates convergence.
C.2. Training Stability
To assess training stability, we train our end-to-end model from scratch using three different seeds (5k steps each) and show the loss history and performance metrics in Fig. 12. We find that our models with different seeds converge in terms of detection loss and accuracy as the training process continues.
18

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
0.9
Detection Loss
Accuracy
Dec Loss (seed, 63)
Loss (seed
0.6
ACC (seed. 631
ACC (seed_o4 04)
0.5
(seed, (51
Step (k)
Figure 12. Training history of our model with three different seeds (63, 64, and 65).
Table 16. Editing configurations used in robustness evaluation.
Edit
Description
Parameters Replace ratio: 0.5
Synonym substitute
Using BERT-large (Devlin, 2018) to select synonyms that fit the context.
Paraphrasing
Paraphrasing the text while maintaining the original meaning with the deep paraphrase model Dipper(Krishna et al., 2023).
Lex diversity: 60
Order diversity: 0
Copy-paste
Concatenating the watermarked text after the human- humtnnwritten text creates mix with only parts of the watermarked text.
Watermark segment ratio: 25%
C.3. Editing Configuration
We compare the robustness watermark methods across 3 types of editing. The setting of all edits strictly followed the open-souree studies, MARKLLM and SIR For transparency, we provide a detailed description in Table 16, parameter setting for each text editing.
C.4. Examples of online text modification
Although training pipeline primarily only paraphrasing for editing, we demonstrate the potential of online text modification when integrating the LLM into the proposed end-to-end training framework. By leveraging online prompting techniques, more advanced editing can be achieved. Table 17 provides examples of three more common editing types: random token drop, synonym substitution, and copy-paste attack, along with their corresponding prompts, original texts, and edited outputs.
httn:///ghhaacc/m///U///////AMI "htnps//gituuh.cm//HHUUBBBB Watermark
19

---

An End-to-End Model for Logits-Based Based Large Language Models Watermarking
Table 17. Examples online text modification.
Editing Type
Prompt
Original text
Revised text
Random Drop Tokens
Please randomly drop some words from the below given text:
In significant laap forward for artificial intelligence (AI) technol- ogy, researchers at NeuralNet In- novations have developed an ad- vanced algorithm that promises enhance decision-mate making pabilities Al systems, poten- tially revolutionizing industries from healthcare to autonomous vehicles.
In leap forward for Al technol- ogy, researchers NeuralNet In- novations developed advanced gorithm that promises enhance decision-make making capabilities in systems, potentially revolutioniz- ing industries from healthcare autonomous vehicles.
Synonym Substitute
Please randomly select some words from the below given text and substitute them with their synonyms:
Mental health critical compo- nent of overall well-being and has a significant impact on individu- als' ability to function effectively in their daily lives, including at work. Employers play vital role in promoting mental health by creating supportive environments that encourage open communica- tion, reduce stigma, and provide resources for employees.
Mental health an essential el- ement of general well-being and has substantial influence on in- dividuals' capacity to operate effi- ciently in their everyday lives, in- cluding at work. Employers play a crucial role in advancing mental health by establishing supportive atmospheres that encourage did communication, diminish prej- udice, and offer assets for staff. Global warming is a critical is- sue that affects various aspects of our planet. Climate change is one of the most pressing en- vironmental issues of our time, posing significant threats to bio- diversity worldwide. It leads melting ice caps, rising sea lev- cls, and more frequent natural dis- asters. These changes have pro- found impacts both human so- cieties and wildlife. ...
Copy-paste
Please randomly copy the below given text and paste to the pro- vided human-written text to form the new text:
Climate change is one of the most pressing environmental is- sues of our time, posing signifi- cant threats biodiversity world- wide.
Paragraphing
Rewrite the following paragraph:
We introduce novel logits- based end-to-end model, where encoder and decoder networks are jointly optimized to improve de- tection robustness and text qual- ity. Constructing such a system is challenging due to the non- differentiability of key modules, such as online text editor and semantic loss computation.
We propose novel logits logits-based end-to end model that jointly op- timizes encoder and decoder net- works enhance detection robust- ness and text quality. Developing this system poses significant chal- lenges, particularly due to the non- differentiability of critical compo- nents, including online text ed- itor and semantic loss computa- tion.
20

---

An End-to-End Model for Logits-Based Large Language Models Watermarking
D. Comparison with Post- Generattn Watermarking Methods
Post-generation watermarking methods, such as AWT (Abdelnabi Fritz, 2021) and REMARK-LLM (Zhang et al., 2024), embed watermarks after the text has been fully generated. These approaches rely on a language model to rephrase the generated text, embedding a watermark signal while preserving the semantic meaning of the original sentences, However, post-generation methods have notable limitations. They do not fully leverage the capabilities of the original LLM and are more susceptible to out-of-distribution (OOD) issues. For instance, models trained on datasets like HC3, natural language question-answer answering corpus, often struggle with OOD inputs, such as code, leading to reduced performance on tasks like code generation (e.g., lower code passing scores). In contrast, logits-based methods, including ours, embed watermarks during the generation process by sampling tokens directly from a perturbed distribution. This approach minimally constrains the LLM,, allowing retain its natural understanding of language while maintaining broad compatibility across diverse tasks.
E. Watermark Efficiency
Table 18. Time and memory consumption for generation and detection with 200-token sample of method.
Generation
Detection
LLM
Setting
Time (s)
Memory, (GB)
Time (s)
Memory, (GB)
OPT-1.3B
w/o watermark
2.557
5.900
0.003
0.008
OPT-1.3B
w/ watermark
2.769
5.900
0.003
0.008
Llama2-7B
w/o watermark
5.204
15.793
0.005
0.008
1lama2-7B
w/ watermark
8.362
15.793
0.005
0.008
In Table 18, we assess the computational time overhead and GPU memory usage of our method. For OPT-1.3B, the lightweight encoder design results only an 8.3% increase in generation time for watermarked text, with no change in maximum GPU memory usage since the encoder is invoked after each token generation. For Llama2-7B, our method increases the generation time by 60.6%, mainly due to the embedding transformation from LJama2-7B OPT-I.3B, the tokenizer cannot be accelerated by the GPU and is called at each step. The time overhead for watermark embedding can be mitigated through parallel tokenization, reducing the time complexity by up to 1/k. In terms of watermark detection, our decoder operates efficiently, requiring only negligible time and memory consumption.
Table 19. Detection time (s) on single NVIDIA A6000 GPU for 200-token sample.
Method
Detection Time. (s)
KGW
0.3
EXP-Edit
80
Unbiased
3.4
Ours
0.005
Moreover, our watermark detection is extremely efficient. As shown in Table 19, with Llama2-7B using a single NVIDIA A6000 GPU, our method requires only 0.005 seconds per watermarked sample (200 tokens), compared to 0.3 seconds for KGW, 3.4 seconds for Unbiased, and 80 seconds for EXP-Edit. Overall, our method is 16,000 times faster than EXP-Edit and 680 times faster than Unbiased, making it highly suitable for scalable watermarking systems.
21


Reviews:
[{"review_id": "KkSY4TibvJ", "reviewer": "Reviewer_sPDj", "summary": "The authors propose a method to enhance the robustness of logit-based watermarking techniques while preserving text quality. The main idea is to use a model to generate the \"biases\" for the logits.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer sPDj,\n\nWe sincerely appreciate the time and effort you have dedicated to our manuscript. Below, we summarize the key responses to your concerns.\n\n# Theoretical Guarantees \n\n||1%FPR TPR↑ (CL / SS / CP / PA)|Best F1↑ (CL / SS / CP / PA)|\n|-------------------|---------------------------------|---------------------------------|\n| KGW|1.00 / 0.94 / 0.81 / 0.50| 1.00 / 0.96 / 0.92 / 0.82|\n| Unigram|1.00 / 0.98 / 0.56 / 0.61| 1.00 / 0.98 / 0.85 / 0.92|\n| Ours (Neural Decoder)| 0.99 / 0.96 / 0.96 / 0.75| 1.00 / 0.98 / 0.97 / 0.92|\n| Ours (Statistical Decoder)|0.95 / 0.91 / 0.96 / 0.65| 0.97 / 0.96 / 0.97 / 0.85|\n\nBy retrieving the red-green token lists with our watermark encoder (see Sec. 4.3), we can statistically compute token ratios that provide guarantees similar to provable p-values (analogous to KGW), which is critical for text forensics. Although our neural decoder—benefiting from end-to-end optimization with a noise layer—generally outperforms the statistical decoder, the latter remains competitive with strong baselines. For example, at a fixed 1% FPR, the statistical decoder achieves a TPR of 0.96 in CP and a TPR of 0.65 in PA, compared to KGW’s 0.81 (CP) and 0.50 (PA) as well as Unigram’s 0.56 (CP) and 0.61 (PA).\n\n---\n\n# Additional Computational Overhead\n\nAlthough our model requires extra resources during end-to-end training, we developed a converter that enables efficient, cross-LLM inference without retraining. The additional time shown in Table 11 is due to the converter applying two tokenizers to each of the \\(k\\) input sequences; however, parallel LLM inference (batching prompts) can significantly reduce this overhead.\n\n|Method|Detection Time↓ (seconds)|\n|-|-|\n|KGW|0.3|\n|EXP-Edit|80|\n|Unbiased|3.4|\n|Ours|0.005|\n\nMoreover, our watermark detection is extremely efficient. On Llama2-7B using a single NVIDIA A6000 GPU, our method requires only 0.005 seconds per watermarked sample, compared to 0.3 seconds for KGW, 3.4 seconds for Unbiased, and 80 seconds for EXP-Edit. Overall, our method is 16,000 times faster than EXP-Edit and 680 times faster than Unbiased, making it highly suitable for scalable watermarking systems.\n\n---\n\n# False Positive Rate Under No Attack\n\n|LLM|Best F1 FPR↓|\n|-|-|\n| OPT-1.3B|0.00|\n| Llama2-7B|0.03|\n| Qwen2.5-7B|0.01|\n| Mistral-7B|0.01|\n| Llama3-8B|0.01|\n| Llama3.2-3B|0.01|\n| Average|0.01|\n\nWe present the best F1 FPR for various LLMs. Notably, OPT-1.3B achieves an FPR of 0.00, Llama2-7B is at 0.03, and all other models (Qwen2.5-7B, Mistral-7B, Llama3-8B, and Llama3.2-3B) consistently achieve an FPR of 0.01. With an average FPR of just 0.01, our method demonstrates exceptionally low false positive rates across different LLMs.\n\n---\n\n# Typo\n\nThe missing spaces of the citations in Sec. 4.1.3 and line 803 will be fixed in the final version.", "claims_and_evidence": "The claims are generally supported by enough evidence.", "methods_and_evaluation_criteria": "The methods and evaluation criteria are suitable for the problem.", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "The experimental setup is generally sound.", "relation_to_broader_scientific_literature": "The paper builds on state-of-the-art watermarking methods, such as KGW. Its distinction is that it does not split the vocabulary randomly but instead learns the biases for the tokens, which they show improves the robustness - text quality tradeoff.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "The method moderately improves the robustness-text quality tradeoff compared to the baselines. However, I wouldn’t say the results are groundbreaking.\n\nA few weaknesses I noticed are: (1) The method loses the theoretical guarantees of prior works, such as KGW, regarding false positive rates; (2) The method requires additional compute compared to prior work: the watermark biases predictor needs to be trained, and there is a significant overhead during inference, especially on Llama2-7B.", "other_comments_or_suggestions": "In section 4.1.3, the citations are missing a space.\n\nLine 803 is missing space, too (Table11 --> Table 11)", "questions_for_authors": "What is the false positive rate of the method when it is not under any attack?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "30UAGZ49fB", "reviewer": "Reviewer_bhtZ", "summary": "The paper introduces a logits-based end-to-end model for watermarking LLM generated text. As the existing method can not achieve an optimal balance between text quality and robustness, the authors propose a novel approach that jointly optimizes encoder and decoder to improve both text quality and robustness. Experiments show the proposed method achieves superior robustness while maintaining comparable text quality.\n\nStrength:\n1. End-to-End Optimization: Jointly optimizes encoder and decoder for better alignment and efficiency.\n2. Superior Robustness: Achieves higher resistance to tampering compared to existing methods.\n3. Balanced Performance: Maintains text quality while significantly improving robustness.\n\nWeakness:\n1. Lack some case studies. If the author can add some specific case studies, that would be much better.\n2. Author can include more LLM, besides OPT and llama2.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer bhtZ,\n\nWe sincerely appreciate the time and effort you have dedicated to our manuscript. Below, we summarize the key responses to your concerns.\n\n# Case Study\n   We have included three pairs of non-watermarked and watermarked samples generated from the same prompt in Appendix E (see [here](https://postimg.cc/hQ09L2Wv)), where tokens are color-coded based on the watermark encoder's outputs.\n\n---\n\n# Additional LLMs  \n\n|LLM|Best F1↑ (CL / SS / CP / PA)|Qlt (NWM-PPL↓ / Ours-PPL↓)|\n|-|-|-|\n|Qwen2.5-7B|1.00 / 0.99 / 0.99 / 0.95|8.92 / 10.00|\n|Mixtral-7B|1.00 / 0.97 / 0.99 / 0.92|8.71 / 10.22|\n|Llama3-8B|1.00 / 0.99 / 0.99 / 0.93|5.96 / 7.26|\n|Llama3.2-3B|1.00 / 1.00 / 0.99 / 0.95|6.30 / 7.60|\n\nIn addition to OPT-1.3B and Llama2-7B, we have evaluated our method on four extra LLMs—Qwen2.5-7B, Mixtral-7B, Llama3-8B, and Llama3.2-3B—for robustness and quality (in Sec. 4.2). Our approach consistently achieves a high F1 score (≥ 0.99) on\nclean watermarked samples across all LLMs, demonstrating its stability and reliability. Moreover, it maintains strong robustness against all edited cases, yielding an average F1 score ≥ 0.92. In terms of text quality, our method introduces only a moderate increase in PPL, approximately 1.2× that of non-watermarked baselines.\n\n|Method|Qlt (NLLB-600M-BLEU↑ / Starcoder-pass@1↑)|\n|-|-|\n|NWM|31.79 / 43.0|\n|KGW|26.33 / 22.0|\n|Unigram|26.06 / 33.0|\n|Unbiased|28.95 / 36.0|\n|DiPmark|28.94 / 36.0|\n|Ours|31.06 / 34.0|\n\nWe have also assessed translation quality using NLLB-600M and code generation with Starcoder (in Sec. 4.2). For the machine translation task, measured by BLEU score, our method achieves the highest score, 31.062, outperforming the second-best approach (Unbiased, 28.949) by 7.3%. In the code generation task, evaluated by pass@1, our approach attains a competitive score of 34.0, closely trailing the distortion-free methods (DiPmark and Unbiased both 36.0) while surpassing Unigram and KGW. Notably, our approach exhibits exceptional robustness against distortion-free methods while achieving comparable quality, further demonstrating our superiority.\n\n---\n\n# Training Stability\n   To assess training stability, we will train our end-to-end model from scratch using three different seeds (5k steps each) and will share the loss history and performance metrics once training is complete (the entire training process will take about 60 hours).", "claims_and_evidence": "The claims about improved robustness, maintained text quality, and cross-LLM generalizability are well-supported by the empirical results.", "methods_and_evaluation_criteria": "The methods and evaluation criteria are well-designed for LLM watermarking, with appropriate consideration for both technical performance (robustness) and practical usability (quality preservation across diverse tasks).", "theoretical_claims": "Its contributions are primarily empirical and validated through extensive experimental evaluation, not theoretical analysis.", "experimental_designs_or_analyses": "Maybe the training stability or variance in model performance across different random initializations should be discussed.", "relation_to_broader_scientific_literature": "NO", "essential_references_not_discussed": "NO", "other_strengths_and_weaknesses": "NO", "other_comments_or_suggestions": "NO", "questions_for_authors": "NO", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ugkkxZTMUh", "reviewer": "Reviewer_eHFF", "summary": "This paper proposes an end-to-end model for logits-based LLM watermarking. The model consists of a logit perturbation generation network and a watermark detection network, and these two networks are trained in an end-to-end pipeline. To improve the robustness of watermark, a LLM is used to paraphrase watermarked text, and the detection network are trained to identify the modified watermarked text and non-watermarked text. To improve the quality of watermarked text, a LLM is used to extract the semantic embeddings of watermarked text and non-watermarked, and the cosine distance between the two embeddings is minimized. Experiments compare the detection performance of the watermark text of this method and multiple key-based methods after various tampering, as well as the performance of the watermark text in downstream tasks. Experimental results show the proposed method achieves better robustness and text quality.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer eHFF,\n\nWe sincerely appreciate the time and effort you have dedicated. Below, we summarize the key responses to your concerns. \n\n# Source of Robustness\nWe argue that robustness arises from two factors: \n\n1.**Watermark Decoder**: We compare our neural decoder (ND) with a statistical decoder (SD) based solely on the red/green partition (see response to Reviewer sPDj), and our ND outperformed SD, demonstrating that end-to-end training with a noise layer enhances robustness.\n\n2.**Red/Green Partition**: We measure the KL divergence (KLD) between token distributions of watermark (WM) and non-watermark (NWM) sentences (see [here](https://postimg.cc/RWN7WHMx)) to evaluate the context independence (CI) of our partition. A purely CI partition (e.g., Unigram) shows high KLD due to token biases, while our method achieves a KLD of 0.12—about half of Unigram’s 0.21 and above KGW’s 0.03—indicating a balance between context-dependent (CD) and CI schemes. Our ablation study on context size after paraphrasing is shown below:\n\n|Context Size|1%FPR TPR↑ (PA)|\n|-|-|\n|2|0.69|\n|4|0.76|\n|8|0.79|\n|10|0.80|\n\nOur adaptive partition lets the encoder use strong CD features when available and fall back to a CI approach when necessary, which is crucial for our robustness.\n\n---\n\n# Acquisition of Different Watermarks\nIt is **NOT** necessary to retrain the entire network from scratch for each user-specific watermark. The proposed end-to-end framework is flexible enough to inject key-driven randomness at multiple stages (input, model parameters, or output). In practice, one can fine-tune (FT) and apply key-conditioned post-processing without retraining.\n\nDifferent watermarks can be guaranteed by incorporating a key-driven bias logit $l_B \\in \\lbrace-1,1\\rbrace^n$ (of vocabulary size) into the final watermark logits via $ \\hat{l}_W = \\delta \\times \\text{clip}(l_W + l_B) $. Since $l_B$ is derived from a unique key, statistical analysis demonstrates that each item in the clipped output remains unchanged with probability 0.5 and changes with probability 0.5 (assuming the $i$ item, $\\text{clip}(l_W^{(i)} + l_B^{(i)}) \\sim \\text{Uniform}(-1, 1)$, $l_B^{(i)} \\sim \\text{Uniform}(\\lbrace-1, 1\\rbrace)$, trainable $l_W^{(i)} \\in [-1,1]$, and all items are independent). The number of mismatches between watermarks generated using different keys follows a binomial distribution $\\text{Bin}(n, 0.5)$, implying that the probability of obtaining identical watermarks is negligibly small. E.g. $n = 40$, the probability of identical is $0.5^{40} \\approx 9.1\\times 10^{-13}$. The explanation (with the spoof attack below), which highlights the randomness introduced by the key, will be included in the final version.\n\n---\n\n# Risk of Watermark Stolen\n|1%FPR TPR↓|Dolly CW|MMW BookReports|\n|-|-|-|\n|KGW|0.45| 0.59|\n|KGW (Diff. key)|0.10|0.16|\n|Unigram|0.22|0.04|\n|Unigram (Diff. key)|0.11|0.15|\n|Ours (CD score)|0.13|0.16|\n|Ours (CI score)|0.55|0.56|\n|Ours (CI score, FT w/ $l_B$ 5k steps)|0.19|0.12|\n\nWe conduct a spoof attack with 2,000 queries per method to evaluate resistance against watermark stolen (lower TPR is better). Our method is more vulnerable with CI scoring (0.55 and 0.56 for the two datasets), but FT w/ $l_B$ reduces the TPR to 0.19 and 0.12, which is comparable to using different keys in KGW and Unigram.\n\n| |1%FPR TPR↑ (CL / SS / CP / PA)|Qlt  (PPL↓ / BLEU↑ / pass@1↑)|\n|-|-|-|\n|Ours|0.99 / 0.97 / 0.98 / 0.75|7.73 / 31.06 / 34.00|\n|Ours (FT)|1.00 / 0.98 / 0.99 / 0.53|7.28 / 30.94 / 32.00|\n\nMeanwhile, our FT model shows performance comparable to the original checkpoint. Notably, the PPL improves from 7.73 to 7.28 but the TPR drops from 0.75 to 0.53 in the PA case.\n\n---\n\n# $\\gamma$ of Red-Green Split\n|Hugging Face Dataset|$\\gamma$|\n|-|-|\n|xsum|0.38±0.11|\n|StackOverflow-QA-C-Language-40k|0.43±0.11|\n|ML-ArXiv-Papers|0.40±0.13|\n|mimic-cxr-dataset|0.40±0.12|\n|finance-alpaca|0.41±0.11|\n\nOur method achieves an average $\\gamma$ of 0.4 across datasets with diverse topics.\n\n---\n\n# Compare with SynthID\n| |1%FPR TPR↑ (CL / SS / CP / PA)|Qlt (PPL↓ / BLEU↑ / pass@1↑) |\n|-|-|-|\n|SynthID|0.99 / 0.61 / 0.29 / 0.05|5.71 / 26.13 / 37.00|\n|Ours|0.99 / 0.97 / 0.98 / 0.75|7.73 / 31.06 / 34.00|\n\nOur method consistently outperforms SynthID in editing cases, notably scoring 0.75 versus SynthID's 0.05 in PA, while maintaining competitive quality.\n\n---\n\n# Ratio of Red/Green tokens in Fig 10\nThe ratios between NWM/WM texts are not similar at all, the NWM texts have red/green token counts of 69:53, 61:65, and 74:75 (ratios 1.30, 0.94, and 0.99). In contrast, the WM texts show counts of 42:83, 50:99, and 53:79 (ratios 0.51, 0.51, and 0.67).\n\n---\n\n# Fig 9 Explanation\nLowering the temperature makes the LLM more deterministic, increasing the likelihood of sampling high-logit tokens. Because our model perturbs the top-$k$ logits, a lower temperature favors selecting tokens from our red/green lists over those in the grey list (see Sec. 3.2), thereby improving performance.", "claims_and_evidence": "This paper argues that the proposed end-to-end neural network-based watermarking method is robust and has little impact on text quality. The training method and objective function design in this chapter include these two goals, and the experimental results show that the method is effective in both aspects. However, this paper lacks theoretical justification for the source of watermark robustness, relying primarily on empirical results.", "methods_and_evaluation_criteria": "This paper experimentally evaluates the robustness and quality of generated text of the proposed method compared with the baseline methods. In the key-based watermarking method, the context window size is directly related to the robustness. This paper lacks ablation experiments on the context window size, making the source of the robustness of the watermarking method unclear. In the key-based watermarking method, a watermark with strong robustness is more easily stolen as its watermark pattern space is relatively small, but this problem can be solved by using multiple keys, because different keys can easily create independent watermark patterns. This paper does not explore the risk of the watermark pattern being stolen by the proposed watermarking method and how to mitigate this risk.", "theoretical_claims": "refer to the question and weakness part", "experimental_designs_or_analyses": "The paper contains several experiments to demonstrate the proposed method achieves the two objectives, maintaining text quality and robustness against text modifications.\n1)\tFor text quality, the paper evaluates the proposed with multiple key-based watermarking methods on the perplexity of watermarked text and the metrics (BLEU, pass@1) of downstream tasks including translation and code generation.\n2)\tFor robustness, the paper evaluates the proposed method with multiple key-based watermarking methods on clean watermarked text and corrupted watermarked text under synonymous substitution, copy-paste attack and paragraphing to demonstrate its ability against tampering. \n\nA critical concern about the experiments is that this part lacks experiments and analyses on resisting watermark stealing attacks. Additionally, in the watermarking scenario, measuring the True Positive Rate (TPR) at fixed False Positive Rate (FPR) thresholds would be more informative than using F1 scores alone, as this better reflects real-world requirements where a certain level of false alarms can be tolerated while maximizing detection capability.", "relation_to_broader_scientific_literature": "This article proposes a watermarking method based on neural networks and red-green lists, which achieves better text generation quality and robustness. The red-green list-based watermarking method comes from the literature [1] (Kirchenbauer et al). It uses a pseudo-random number generator with a key to use context tokens as seeds to divide the vocabulary into two sets. By adding a small perturbation (delta) to the logits, the probability of some tokens (called green tokens, with a ratio of gamma) is increased and the probability of another token (called red tokens) is reduced. In the detection stage, by observing the proportion of green tokens in the text and the z-score, it is determined whether the text has a watermark. The key and pseudo-random number generator ensure the unpredictability of the watermark. Replacing different keys can generate independent red and green lists, which increases the security of the watermark. \nReference [2] (Zhao et al.) proposed a robust watermarking method by using a fixed red-green list during text generation, and the authors suggest changing keys to maintain watermark security.\nReference [3] (Jovanović et al.) proposed a method for stealing watermarks (green lists) based on statistical analysis. The conclusion of the reference is that the watermark pattern generated by a single key is easy to be stolen, and using multiple keys to generate watermark text in rotation can alleviate this problem.\nReference [4] (Huo et al.) proposed using a neural network to adjust the proportion of green tokens and the perturbation intensity (delta) of logits based on the use of a pseudo-random number generator to divide the vocabulary. This approach achieves a better balance between watermark detectability and semantic preservation. The contribution of reference [4] is most similar to this paper. However, reference [4], based on the characteristics of the pseudo-random number generator, faces a smaller risk of watermark stealing compared to the current paper's end-to-end neural approach. \nOverall, using neural networks to improve robustness and text generation quality is feasible, as demonstrated in this paper. However, the authors appear to have overlooked the increased security risks associated with their approach, particularly the vulnerability to watermark stealing attacks that may be more pronounced in end-to-end neural models compared to key-based methods with flexible pattern switching capabilities.\n\n[1] Kirchenbauer, John, et al. \"A watermark for large language models.\" International Conference on Machine Learning. PMLR, 2023. \n[2] Zhao, Xuandong, et al. \"Provable Robust Watermarking for AI-Generated Text.\" The Twelfth International Conference on Learning Representations.\n[3] Jovanović, Nikola, Robin Staab, and Martin Vechev. \"Watermark Stealing in Large Language Models.\" International Conference on Machine Learning. PMLR, 2024.\n[4] Huo, Mingjia, et al. \"Token-specific watermarking with enhanced detectability and semantic coherence for large language models.\" Proceedings of the 41st International Conference on Machine Learning. 2024.", "essential_references_not_discussed": "One key contribution of this paper is maintaining text quality of watermarked LLM, but the state-of-the-art method on this topic, namely SynthID published in Nature does not been cited and compared. However, it is understandable given that SynthID was published in October 2024, only about 3 months before the conference deadline.", "other_strengths_and_weaknesses": "Strengths: \n1.\tThis paper develops an end-to-end neural network-based watermarking method to achieve a better balance between watermark robustness and maintaining text quality.\n2.\tThis paper proposes two techniques to improve watermark performance and practice model training. One is to let the classifier distinguish the watermarked text paraphrased by LLM, and the other is to use LLM to generate the semantic embeddings of watermarked text and non-watermarked text.\n\nWeaknesses:\n1.\tThe source of the robustness of the watermarking method in this paper is unclear. It may stem from the ability of detector, or the watermark pattern, or both. For watermark pattern, this method does not constrain the diversity of red-green partitions or the proportion of green tokens. An extreme example is that the neural network may produce a globally invariant red-green partition similar to UniGram. \n2.\tThe author did not discuss the risk of the proposed watermarking being stolen. Generally, high robustness will bring a higher risk of watermark stealing. The key-based method can alleviate this problem by changing the key, but the flexibility of the end-to-end architecture in this paper is weaker, resulting in this risk that cannot be ignored.\n3.\tHigh computational cost and low flexibility. The key-based watermarking method can obtain independent watermarking patterns at zero cost by rotating the key. The watermarking based on the end-to-end model requires high computational cost, and it is difficult to guarantee the acquisition of independent and different watermarking modes even after retraining, which limits its practical application scope.", "other_comments_or_suggestions": "1.\tImprove transparency of methodology by extracting and analyzing the red-green split and logits perturbations produced by the model to more clearly illustrate the source of the robustness of this method.\n2.\tDiscuss how to mitigate the risk of watermark stealing.\n3.\tDiscuss how to obtain diverse watermarks efficiently without requiring complete retraining of the model.", "questions_for_authors": "1.\tFor key-based watermark, different pseudorandom number generator with different keys can provide different watermark for different users. For this end-to-end watermark, there are two questions: I) To create different watermarks for different users, should the networks be train from the beginning to end? II) How to guarantee different watermarks trained from the same neural network framework are distinguishable? \n2.\tHow are the differences in the red-green partition and logits perturbation of the watermark patterns generated by the proposed method for different contexts? For example, what is the ratio of green tokens in the red-green partition for different contexts, and how is the difference in logits perturbation?\n3.\tIn Figure 10 of Appendix E, why are the ratios of green tokens and red tokens similar for the non-watermarked text and the watermarked text?  \n4.\tFigure 9 of Appendix C shows that as the LLM temperature decreases, the F1 of the watermark detection of some watermarking methods decreases. It stands to reason that as the temperature decreases, the uncertainty/diversity of the text generated by LLM will increase, and the increase in text entropy will improve the watermark effect. The experimental results here are inconsistent with this conclusion. What do the authors think is the reason for this phenomenon? Is this because the watermark method applies the logits/probability distribution before the temperature processing, rather than after the temperature processing?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper proposes an end-to-end model to watermark LLM generated text. The model consists of a logit perturbation generation network and a watermark detection network, and these two networks are trained in an end-to-end pipeline. To improve the robustness of watermark, a LLM is used to paraphrase watermarked text, and the detection network are trained to identify the modified watermarked text and non-watermarked text. To improve the quality of watermarked text, a LLM is used to extract the semantic embeddings of watermarked text and non-watermarked, and the cosine distance between the two embeddings is minimized. Experiments compare the detection performance of the watermark text of this method and multiple key-based methods after various tampering, as well as the performance of the watermark text in downstream tasks. Experimental results show the proposed method achieves better robustness and text quality.

Strengths:
- The paper jointly optimizes encoder and decoder to improve watermarking quality and robustness. 
- The paper proposes two techniques to improve watermark performance and practice model training.

Weakness: 
- The paper lacks a theoretical analysis of generation quality, detection rate, and robustness. It is unclear whether the original KGW guarantees still hold. 

Reviewers' additional concerns regarding fine-tuning cost, source of robustness, experiments of watermark stealing attacks are addressed by the authors during rebuttal.
Decision: Accept (poster)