The paper demonstrates that N‑gram based code watermarking schemes, widely used to identify machine‑generated code, are ineffective when faced with realistic code obfuscation. By modeling semantics‑preserving transformations as a Markov random walk and introducing the assumption of distribution consistency, the authors prove that obfuscation can drive the failure rate of any detector to nearly 1 minus its false‑positive rate. Extensive experiments across multiple watermarking methods, LLMs, languages, benchmarks, and obfuscators confirm that detectors collapse to near‑random performance (AUROC ≈ 0.5) after obfuscation.
By Gehao Zhang, Mingzhe Li, Eugene Bagdasarian, Shiqing Ma, Juan Zhai
arXiv:2606. 18430v1 Announce Type: new Abstract: Statistical watermarks help organizations attribute large language model (LLM) outputs, yet existing detectors often struggle when watermark signals are weak, texts are repetitive, or watermarks are edited.
By Chih-Duo Hong, Yen-Pang Chen, Fang Yu
arXiv:2608.29212v1 Announce Type: cross
Abstract: Existing video watermarking systems are symmetric: the party that can verify a mark holds the extractor weights or generator secret and can therefore...
By Guang Yang, Fengchen Liu
arXiv:2603. 23171v3 Announce Type: replace-cross Abstract: Providers monitor deployed large language models (LLMs) to detect misuse that they cannot prevent.
By Toluwani Aremu, Daniil Ognev, Samuele Poppi, Nils Lukas
arXiv:2502. 02068v3 Announce Type: replace-cross Abstract: This paper introduces RoSeMary, the first-of-its-kind ML/Crypto codesign watermarking framework that regulates LLM-generated code to avoid intellectual property rights violations and inappropriate misuse in software development.
By Ruisi Zhang, Neusha Javidnia, Nojan Sheybani, Farinaz Koushanfar
WeaveMark is a new multi‑bit watermarking scheme for large language models that improves payload capacity, extraction accuracy, and text quality by using coded payload spreading, soft‑decision error‑correcting codes, and unbiased multilayer reweighting. It also adds zero‑bit layers for reliable detection of watermark presence. Experiments demonstrate significant gains, achieving an 89.8% match rate for 32‑bit messages at 200 tokens and maintaining 86.0% accuracy under 10% substitution attacks on 16‑bit messages, far outperforming the BiMark baseline.
By Gang-Hyun Park, Ju-Hyeong Lee, Hee-Youl Kwak, Dae-Young Yun
arXiv:2609.37310v1 Announce Type: cross
Abstract: With LLM watermarking being deployed commercially and now required by regulations, improving its reliability and effectiveness has become crucial. Ye...
By Thibaud Gloaguen, Robin Staab, Martin Vechev
arXiv:2601. 22818v2 Announce Type: replace-cross Abstract: Fine-tuned LLMs can covertly encode prompt secrets into outputs via steganographic channels.
By Charles Westphal, Keivan Navaie, Fernando E. Rosas
arXiv:2609. 03844v1 Announce Type: cross Abstract: We introduce Stateless Bernoulli Watermarking (SBW), a new statistical watermark for Large Language Models that determines green list membership through independent per-token Bernoulli trials.
By Simone Ceppi, Ignacio Sanchez
arXiv:2607. 13099v1 Announce Type: cross Abstract: Large language models (LLMs) have achieved remarkable success but raise growing concerns about content provenance and misuse, motivating the need for reliable watermarking techniques.
By Z Sun, Q Jiang, S Sheng, L Xiang
arXiv:2608. 03174v1 Announce Type: cross Abstract: Generative AI systems increasingly produce content whose provenance is difficult to verify, motivating watermarking techniques for identifying model-generated outputs.
By Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel, Er-Cheng Tang
We introduce Stateless Bernoulli Watermarking (SBW), a new statistical watermark for Large Language Models that determines green list membership through independent per-token Bernoulli trials. Unlike KGW's vocabulary permutation or SynthID's multi-layer tournament, SBW requires only a single comparison per token against a counter-based random number generator, reducing membership complexity to $O(1)$ and enabling single-kernel execution with zero intermediate allocations.