Jun 2025· arXiv.org· Vol abs/2506.22343· 5 citations· ⚡ 1 influential
MathematicsComputer Science
TL;DR
This paper addresses the problem of optimally estimating the watermark proportion in mixed-source texts, and proposes efficient estimators for this class of methods, and derive minimax lower bounds for any measurable estimator based on pivotal statistics, showing that their estimators achieve these lower bounds.
Abstract
Text watermarks in large language models (LLMs) are an increasingly important tool for detecting synthetic text and distinguishing human-written content from LLM-generated text. While most existing studies focus on determining whether entire texts are watermarked, many real-world scenarios involve mixed-source texts, which blend human-written and watermarked content. In this paper, we address the problem of optimally estimating the watermark proportion in mixed-source texts. We cast this problem as estimating the proportion parameter in a mixture model based on \emph{pivotal statistics}. First, we show that this parameter is not even identifiable in certain watermarking schemes, let alone consistently estimable. In stark contrast, for watermarking methods that employ continuous pivotal statistics for detection, we demonstrate that the proportion parameter is identifiable under mild conditions. We propose efficient estimators for this class of methods, which include several popular unbiased watermarks as examples, and derive minimax lower bounds for any measurable estimator based on pivotal statistics, showing that our estimators achieve these lower bounds. Through evaluations on both synthetic data and mixed-source text generated by open-source models, we demonstrate that our proposed estimators consistently achieve high estimation accuracy.
Watermarking provides a principled way to authenticate text generated by large language models (LLMs). In practice, however, the final text may be mixed-source, with watermark evidence surviving at only a subset of token positions after rewriting, insertion, deletion, or paraphrasing. Although prior work has studied gl...
José H. Blanchet, T. Cai, Xiang Li et al.· 1 citation· ⚡1
This work provides a lower bound that shows that it is impossible to improve performance by adding watermarks unless the false negative rate of detection also vanishes, and shows that in most regimes, the worst-case losses of a sequence of simple deterministic estimators match the corresponding lower bounds up to const...
Predictive likelihood ratios that average over uncertain probability deficits and residual-tail distributions are constructed, showing robustness across the evaluated alternatives, not uniform power guarantees or resistance to arbitrary text edits.
This work introduces OpenStamp, a watermarking technique that encodes the watermarking logic directly into the model weights by modifying only the final projection, or unembedding, layer, and shows that OpenStamp achieves superior detection performance, with minimal degradation in model capabilities compared to prior m...
Results show that the copy–paste attack degrades watermark detectability when using very sparingly and only short sentences are used, while deletion becomes effective only at extreme levels on short texts, and underscore the need for future watermark designs to prioritise resilience to semantic and cross-lingual transf...
Jakob Elias Albrecht, A. Jakoby, Benno Maria et al.· 0 citations
TripPattern is a watermarking framework that formulates text watermarking as a pattern-based matching task using three vocabulary partitions, which maintains LLM generation quality while achieving robust watermark detectability.
Sang-Jun Moon, Dasom Choi, Jingun Kwon et al.· 0 citations
Zero-knowledge proofs can verify computing results without rerunning workloads or exposing sensitive data. Magnetar helps bring them into the mainstream with support for standard programming languages, major speed gains, and quantum-resistant security. The post Proof-based general-purpose computing with Magnetar appeared first on Microsoft Research.
Learn how Google DeepMind and GovTech Singapore uses lightweight on-device Gemma models to intercept conversational scams in private chats with zero cloud data egress.