{"id":"be39ada0-2dd2-469e-b3a6-eac79db02f78","arxiv_id":"2412.19603","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Proposes a single-bit LLM watermark via dual inverse transform sampling, extended to a multi-bit hash-chained scheme for forgery resistance.","lead":"Researchers propose a watermark for AI-written text that hides a 0 or 1 bit in every generated bit without changing the model's output distribution. The paper claims this enables unforgeable watermarks via hash chains, but the formal definitions contain errors, and the promised experiments are missing from the preprint.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Equation (5) defines the output bit b in terms of p(b), making the sampler ill-posed: for many random draws and distributions no bit satisfies the equation, so the central watermark construction is not well-defined.","rationale":"The reader's formal weakest_assumption focuses on the minimum entropy of the predictor being too small; that is a real practical concern about block length. However, the most load-bearing issue is more basic: Section 4.1's central equation b = 1(r < p(b)) XOR m is self-referential and admits no solution for many inputs, so the proposed Wat-Sampler is not a well-defined algorithm. Every subsequent claim -- distribution preservation (Claim 1), undetectability (Claim 3), correctness (Claim 2), robustness (Claims 4-5), and the multi-bit construction -- is a property of this sampler; if the sampler is undefined, the central contribution cannot be assessed from the text as written. I agree with the reader's verdict of REJECT, but for this more foundational reason. The entropy assumption is secondary: even under an ideal predictor with constant min-entropy, the ill-posed definition prevents implementation. My proposed test directly checks whether the equation has solutions for a concrete instantiation; it will settle whether the issue is a typo or a genuine gap. Since the reader already rejected the paper, my concern does not change the verdict.","tokens_in":16498,"tokens_out":6216,"duration_ms":48835,"concrete_test":"Instantiate the literal Eq. (5) for p(0)=0.7, p(1)=0.3, m=0, and r=0.5; show that neither b=0 nor b=1 satisfies the equation, demonstrating that the sampler is undefined on a set of positive measure. Then compare with the rule used in Claim 1's proof (m=0 outputs 0 when r<p(0); m=1 outputs 1 when r<p(1)) and verify that the proof's probability computation does not follow from Eq. (5), confirming the need for a corrected definition before any property of the scheme can be evaluated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Section 4.1, Wat-Sampler is defined by Eq. (5): b = 1(r < p(b)) XOR m, and Algorithm 1 returns the same expression. Since b appears on both sides, this is a fixed-point definition rather than a computation. For p(0)=0.7, p(1)=0.3, m=0, and r=0.5, substituting b=0 gives 1(0.5<0.7) XOR 0 = 1, and substituting b=1 gives 1(0.5<0.3) XOR 0 = 0; neither candidate satisfies the equation, and no output bit exists. For r in [p(1), p(0)) there is no solution, so the sampler is undefined on a positive-measure set of random inputs. The proofs of distribution preservation, undetectability, correctness, and robustness in Claims 1-4 all reason about a sampler that flips the inverse-transform region depending on m, matching Figure 1 rather than Eq. (5). Thus the central algorithm as written cannot be implemented or tested, and the paper's main claim rests on an ill-posed definition. This is not a matter of a missing experiment; the formal object is absent.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a single-bit watermarking scheme for language models, claiming undetectability, robustness, and extensibility to a multi-bit unforgeable scheme that hashes the prompt and previous content into watermark links. The core construction is a 'Wat-Sampler' (Eq. 5) and a detector (Eq. 7), together with aggregation via Hoeffding bounds and a multi-bit chain built on hash values. The abstract also promises 'sufficient experiments' on popular language models. As written, however, the central sampler definition is self-referential and not computable, the detection formula is inconsistent with the paper's own figures and analysis, the decision rule in the algorithm is reversed relative to the derived expectations, the unforgeability proof is only a one-sentence appeal to collision resistance, and Section 5 contains no actual experiments or results.","tokens_in":16696,"tokens_out":15539,"duration_ms":120628,"significance":"The intended idea, a dual inverse-transform sampling that embeds a bit without changing the marginal output distribution, is a plausible and potentially useful building block for language-model watermarking. If the construction were correctly specified and the gaps in the analysis filled, the paper could be a valuable contribution to the undetectable- and unforgeable-watermark literature. However, the manuscript as submitted does not contain a well-defined central algorithm: Eq. (5) is not a sampling rule, and the detection rule is inverted with respect to the analysis. Because the formal claims are about an object different from the one actually defined, the current version does not establish its main results. The absence of any experimental content further weakens the paper's practical claims.","major_comments":[{"comment":"The definition b = 1(r < p(b)) ⊕ m is a fixed-point equation, not a computable sampling rule, because b appears on both sides. For p(0)=0.7, p(1)=0.3, m=0, and r=0.5, neither b=0 nor b=1 satisfies the equation, so the sampler is undefined on a positive-measure set of random inputs. The subsequent proofs (Claim 1, Figure 1, and the games in Figure 3) use a different, well-defined dual inverse-transform rule. The manuscript must replace Eq. (5) and Algorithm 1 with the explicitly sequential rule used in the proofs, or the central construction is absent.","section":"§4.1, Eq. (5) and Algorithm 1"},{"comment":"The detection formula m' = 1(r < 1/2) ⊕ b is the inverse of the rule that the paper's own analysis uses. With the construction in Figure 1, for p(0)=p(1)=1/2 and m=0, r<1/2 gives b=0, and Eq. (7) yields m'=1; the paper's text immediately after Eq. (7) claims the opposite. Figure 2 and Eqs. (8)-(13) are consistent with the rule m' = 1(r ≥ 1/2) ⊕ b, not with Eq. (7). This is not a typographical issue: the detection algorithm as written would output the wrong watermark bit.","section":"§4.1, Eq. (7), Algorithm 2, and Figure 2"},{"comment":"Even if Eq. (7) were corrected to match Figure 2, the decision rule in Algorithm 4 and the bullet list in Section 4.1 is reversed. Equations (11) and (12) put E[X | m=0] below 1/2 and E[X | m=1] above 1/2, yet the algorithm outputs m=0 when X > 1/2 and m=1 when X < 1/2. The detector as specified would systematically misclassify the embedded bit.","section":"§4.1, Eqs. (11)-(12) and Algorithm 4"},{"comment":"The stopping condition in Algorithm 3 relies on the empirical mean X deviating from 1/2 enough to make exp(-i(X-1/2)^2/2) negligible. The required block length depends on the gap δ = (1/N) Σ min{p_i(0), p_i(1)}. The paper only assumes δ > 0; it does not show that δ is non-negligible, nor that Embed terminates in expected polynomial time. For real token-level models converted to bits, min{p(0), p(1)} can be extremely small, and the necessary block length could be impractically large. The paper provides no measurement of this quantity, so the claimed practical effectiveness is unsupported.","section":"§4.1 and §4.2 (Claim 2)"},{"comment":"The proof of prefix-unforgeability consists of a single sentence citing collision resistance of the hash. The game in Definition 11 allows the adversary to modify the transcript arbitrarily, and the reduction is not established: an adversary need not find a hash collision, but could truncate, insert, or overwrite bits so that the decoded watermark bits pass Verify without any hash collision. The proof must explicitly model the decoding procedure, the robustness threshold, and the exact role of the hash, and show how any winning strategy leads to a collision or a second-preimage.","section":"§4.4, Claim 6"},{"comment":"The paper claims in the abstract to provide 'sufficient experiments' and that the results show the method is 'practically effective and robust,' but Section 5.1 ends after a single sentence ('We set the negl(λ) as e^{-λ}.') and no experiments, datasets, models, baselines, or result tables are included. The empirical claims are thus entirely unverified in the manuscript.","section":"§5"}],"minor_comments":[{"comment":"'gumble-softmax' should be 'Gumbel-softmax'.","section":"§2.2"},{"comment":"'Ineqality' should be 'Inequality'.","section":"§4.1, Lemma 1 title"},{"comment":"The condition 'if m_i ≠ ⊥' should be 'if m' ≠ ⊥', since the variable m_i is not defined at that point.","section":"Algorithm 6, line 4"},{"comment":"'Single W atermark Output' should be 'Single Watermark Output'.","section":"Definition 5 title"},{"comment":"The pseudocode for G2 and G3 outputs 1 when r ≤ p(0), which is the inverse of the inverse-transform sampling described in the text; although the distribution is preserved up to relabeling, the code should match the intended mapping.","section":"Figure 3"},{"comment":"The conversion from token-level language models to the bit-level Model is described only informally; Section 5.1 offers no additional implementation details despite its title.","section":"§3.2"}],"recommendation":"reject","confidential_remarks":"The intended construction is recognizable and could in principle be rehabilitated, but the manuscript's core definitions are mutually inconsistent: the sampler is not well-defined, the detector is inverted, the decision rule is reversed, and the unforgeability proof is not a proof. The missing experimental section is an additional concern. A reject rather than a major revision seems appropriate because the formal object of the paper needs to be rebuilt from the definitions upward, not locally repaired."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. The core idea is a neat bit-level trick: flip the inverse-transform region to encode a watermark bit while preserving the output distribution. That part, read as in Figure 1, is sound and worth remembering. But the paper as written has a load-bearing formal bug in the very definition of the sampler, the detector equation contradicts the paper's own analysis, the robustness proof argues in the wrong direction, and the promised experiments are simply absent. The current version should not be accepted.\n\nThe good: the DITS construction is a simple variant of inverse-transform sampling that is genuinely distinct from the existing zero-bit schemes. The undetectability proof for the intended sampler is basically correct. The multi-bit construction using a hash chain to bind prompt and prefix is a standard, reasonable way to get unforgeability, though it inherits the single-bit scheme's problems. The paper is readable and the problem (prompt misattribution, integrity) is real and under-addressed.\n\nThe soft spots are not minor. Equation (5) defines the output bit b in terms of p(b), so b appears on both sides. For p(0)=0.7, p(1)=0.3, m=0, r=0.5, no bit satisfies the equation. The sampler is undefined on a positive-measure set. Figure 1 makes the intended behavior clear, so an editor might treat this as a mangled definition, but as written Algorithm 1 is not implementable. Equation (7) has the same kind of sign problem: with m'=1(r<1/2) XOR b, the error probabilities do not match the paper's own Fig. 2 and Eqs. (11)-(12). Algorithm 4 then assigns X>1/2 to m=0, while Eqs. (11)-(12) say m=0 should have expectation below 1/2. These are internal contradictions in the central algorithm. Claim 4's robustness proof derives a lower bound exp(...) > negl^{1/4}, but the detection rule requires exp(...) < negl; the inequality goes the wrong way, so the proof does not establish robustness. Finally, the abstract claims sufficient experiments, but Section 5 stops after 'Implementation Details' and one line about negl; there are no experiments.\n\nWho is this for? Someone mining watermarking papers for ideas could take the DITS concept and fix it. Nobody should rely on the results as stated. The entropy assumption is also unquantified: if the bit-level min probability is tiny, the required block length grows as 1/gap^2, which may be impractical for real token-level models.\n\nRecommendation: desk-reject the current version. If the authors repair the definition, reconcile the detector with the analysis, fix the robustness proof, and add actual measurements, it could be a worthwhile conference paper.","headline":"A neat bit-level watermarking idea, but the formal write-up is broken at the sampler definition and detector equations, and the experiments are absent.","tokens_in":17251,"tokens_out":10523,"would_cite":false,"duration_ms":92192,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims the first undetectable, robust, single-bit watermark for language models, and chains hash-linked blocks so that prompt forgery and tampering are verifiable.","keywords":["language model watermarking","single-bit watermark","unforgeability","computational indistinguishability","dual inverse transform sampling","hash chain","robustness","forgery attack"],"falsifier":"Measure $\\min\\{p(0),p(1)\\}$ from a real token-level language model on ordinary prompts, compute the block length $N$ needed to make $\\exp\\!\\left(-2N\\,\\mathrm{gap}^2\\right)$ negligible where $\\mathrm{gap}=\\frac{1}{N}\\sum_i \\min\\{p_i(0),p_i(1)\\}$, and check whether that $N$ fits inside a realistic model response; if the measured gap is so small that $N$ exceeds practical response lengths, the central claim of practical effectiveness is falsified.","tokens_in":16259,"feed_emoji":"🛡️","tokens_out":10345,"duration_ms":91274,"temperature":0.7,"pith_summary":"This paper claims to be the first to build an undetectable, robust, single-bit watermark for language models, and then a multi-bit unforgeable chain on top of it. The single-bit trick is a sampling rule that hides a 0 or 1 payload without changing the model's output distribution, so a detector can read the bit back from any sufficiently long block while an adversary cannot tell watermarked from unwatermarked text. The multi-bit construction turns the hash of the prompt and of previously generated blocks into the watermark payloads, so changing the prompt or editing the text breaks a verifiable hash chain. If the construction works as claimed, model providers could answer both “is this our output?” and “under which prompt?” at the same time, closing both prompt-misattribution and robustness-exploiting forgery attacks. The cost the paper accepts is that correctness relies on the bit-level predictor keeping a non-negligible minimum probability on enough positions.","feed_headline":"One-bit watermark keeps LLM text both robust and unforgeable","feed_subtitle":"A sampling trick hides a 0/1 bit with no distribution shift; hash chains catch prompt forgery and edits.","key_machinery":"The central object is the Dual Inverse Transform Sampling (DITS) rule, which replaces the model's sampler. For a next-bit distribution $(p(0), p(1))$ and a shared pseudorandom $r \\in [0,1]$, DITS outputs a bit by checking which side of the predictor's threshold $r$ falls on, taking the complementary arrangement when the watermark bit is $1$; the detector reads each bit as $\\hat{m}' = \\mathbf{1}(r < \\frac{1}{2}) \\oplus b$ and aggregates the votes over a block. DITS does the work of making the watermark invisible: the marginal distribution of the output bit equals the predictor's distribution regardless of $m$, so the watermarked model is computationally indistinguishable from the original. Aggregation does the work of making the watermark reliable and robust: the vote mean concentrates around $\\frac{1}{2} \\pm \\mathrm{gap}$, and a majority of flipped votes can be tolerated up to a Hamming radius. The multi-bit scheme adds a hash chain called a watermark link, where the payload of each block is one bit of the hash of the prompt or of the preceding content, and Verify recomputes the chain; this is the mechanism that turns robustness into unforgeability.","core_discovery":"The paper's central claim is that a one-bit watermark can be both statistically undetectable and robust, and that chaining such bits makes the watermark prefix-unforgeable. The key identity is the pair of complementary sampling and detection rules: a bit is generated by comparing a shared pseudorandom number $r$ against the predictor's thresholds under one arrangement for watermark bit $m=0$ and the mirror arrangement for $m=1$, and it is recovered by testing whether $r$ falls below $\\frac{1}{2}$ and XORing the result with the observed bit. Because the sample mean of these per-bit votes sits at $\\frac{1}{2} \\pm \\frac{1}{N}\\sum_i \\min\\{p_i(0), p_i(1)\\}$, the three states $0$, $1$, and $\\bot$ (no watermark) are separated by a gap that Hoeffding's inequality makes overwhelming once enough bits are gathered. Repeating this within a block yields one watermark signal, and using the bits of $\\mathrm{Hash}(\\text{prompt} \\| \\text{previous block})$ as the signals for successive blocks gives a chain whose first link binds the text to its actual prompt and whose later links expose modification. The paper proves correctness, computational undetectability, and substitution robustness for the single-bit scheme, and prefix-unforgeability for the multi-bit chain under collision resistance of the hash.","pith_inferences":["Beyond the paper, the same DITS construction could be applied per token rather than per bit by encoding token IDs into bit lists, but the effective minimum probability would then be governed by the least likely prefix across the vocabulary, which may be far smaller than the bit-level values the paper assumes; measuring this on real models is the natural next check.","Beyond the paper, the robustness guarantee is stated only against substitution flips; deletions and insertions would desynchronize the shared randomness between embedder and detector, so an edit-robust extension would need an alignment or reset mechanism the paper does not provide.","Beyond the paper, the hash-chain verification is keyed and private; turning it into a publicly verifiable scheme would require a signature or zero-knowledge component, which the paper explicitly avoids because bit payloads are expensive, so a public-verifiability version may need a different trade-off.","Beyond the paper, prefix-unforgeability leaves the final open-ended link unchecked; a truncation attack that cuts the chain at a complete link boundary would still pass Verify, so the scheme detects modification only where a successor link exists."],"forward_implications":["A detector can now distinguish three states from a watermarked text: signal 0, signal 1, and no signal, so a single generated response can carry a meaningful payload rather than only a yes/no flag.","Because the first watermark link carries the hash of the actual prompt, claiming a watermarked output was produced under a different prompt fails verification with overwhelming probability.","Because later links carry hashes of the preceding content, any substitution that flips enough bits to change the content is exposed when Verify recomputes the chain, even though the watermark signal itself is still detectable.","Watermarked text remains computationally indistinguishable from ordinary model output, so the scheme does not degrade text quality or change the sampling distribution.","The scheme's substitution robustness is proportional to the square root of the block length, so longer responses tolerate more edits before detection fails."],"supporting_citations":[{"why":"Supplies the undetectable zero-bit watermark whose robustness the single-bit scheme claims to match and which serves as the main baseline.","marker":"[4]"},{"why":"Introduces the distortion-free gumbel-softmax watermark that DITS extends, establishing the sampling-with-shared-randomness paradigm.","marker":"[1]"},{"why":"Provides the zero-bit scheme whose straightforward multi-bit extension is claimed to degrade robustness, and also serves as a robustness benchmark.","marker":"[3]"},{"why":"Is the prior unforgeable and forgery-focused multi-bit scheme, contrasted on the minimum-entropy assumption and weak robustness.","marker":"[6]"},{"why":"Is cited as proving that the minimum-entropy steganography assumption is unrealistic for language models, motivating the new construction.","marker":"[12]"},{"why":"Presents a multi-bit scheme via multiple keys that the paper rejects as computationally unaffordable for long payloads, shaping the design choice.","marker":"[5]"},{"why":"Establishes the red-green robust watermark baseline and the robustness-exploiting forgery concern that the paper addresses.","marker":"[13]"}],"fun_headline_variants":["One-bit watermark locks LLM output to its prompt","Chain of single bits catches prompt forgery in LLMs","Undetectable one-bit watermark exposes edits","Hash-chain watermark makes LLM content unforgeable","Single-bit scheme thwarts watermark forgery in LLMs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole construction stands on the assumption that the model's bit-level next-bit predictor keeps both bit values reasonably likely over enough generated positions; if real token-level models are often near-deterministic at the bit level, the statistical gap between watermarked and unwatermarked output shrinks and the block length needed becomes impractical.","fun_headline_variants_meta":{"raw":{"variants":["One-bit watermark locks LLM output to its prompt","Chain of single bits catches prompt forgery in LLMs","Undetectable one-bit watermark exposes edits","Hash-chain watermark makes LLM content unforgeable","Single-bit scheme thwarts watermark forgery in LLMs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000291,"raw_usage":{"total_tokens":1769,"prompt_tokens":1081,"completion_tokens":688,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":697,"completion_tokens_details":{"reasoning_tokens":612}},"tokens_in":697,"tokens_out":688,"duration_ms":7309,"temperature":1.0,"reasoning_tokens":612,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:11:46.224542+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure $\\min\\{p(0),p(1)\\}$ from a real token-level language model on ordinary prompts, compute the block length $N$ needed to make $\\exp\\!\\left(-2N\\,\\mathrm{gap}^2\\right)$ negligible where $\\mathrm{gap}=\\frac{1}{N}\\sum_i \\min\\{p_i(0),p_i(1)\\}$, and check whether that $N$ fits inside a realistic model response; if the measured gap is so small that $N$ exceeds practical response lengths, the central claim of practical effectiveness is falsified.","supporting_citations":[{"cited_title":"Undetectable watermarks for language models","cited_arxiv_id":null,"evidence_quote":"Supplies the undetectable zero-bit watermark whose robustness the single-bit scheme claims to match and which serves as the main baseline."},{"cited_title":"Simons institute talk on watermarking of large language models, 2023","cited_arxiv_id":null,"evidence_quote":"Introduces the distortion-free gumbel-softmax watermark that DITS extends, establishing the sampling-with-shared-randomness paradigm."},{"cited_title":"Pseudorandom error-correcting codes","cited_arxiv_id":null,"evidence_quote":"Provides the zero-bit scheme whose straightforward multi-bit extension is claimed to degrade robustness, and also serves as a robustness benchmark."},{"cited_title":"Publicly-detectable watermarking for language models, 2024","cited_arxiv_id":null,"evidence_quote":"Is the prior unforgeable and forgery-focused multi-bit scheme, contrasted on the minimum-entropy assumption and weak robustness."},{"cited_title":"Jois, Matthew Green, and Aviel D","cited_arxiv_id":null,"evidence_quote":"Is cited as proving that the minimum-entropy steganography assumption is unrealistic for language models, motivating the new construction."},{"cited_title":"Watermarking language models for many adaptive users","cited_arxiv_id":null,"evidence_quote":"Presents a multi-bit scheme via multiple keys that the paper rejects as computationally unaffordable for long payloads, shaping the design choice."}],"review_version":1}