{"id":"3b12bfa2-0934-4b1b-ade7-e19a3aa3798b","arxiv_id":"2501.12174","paper_version":6,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"BiMarker splits generated text into alternating positive and negative poles and uses the difference in green-token counts to detect LLM watermarks more accurately than KGW.","lead":"This paper proposes BiMarker, a watermarking scheme that alternates which vocabulary list an LLM favors during generation, then detects the watermark by comparing favored-token counts across alternating segments. The authors report improved detection accuracy over the standard KGW watermark at no extra inference cost, especially for weak watermarks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3.1's proof is incompatible with Algorithm 1's green-list definition, so the claimed theoretical advantage over KGW is unproven as stated.","rationale":"The reader's weakest assumption identifies exactly this convention mismatch: Algorithm 1 assigns the negative-pole green list as list2 of size (1-gamma)|V|, while the proof of Theorem 3.1 uses the KGW bound that applies to a green list of size gamma|V|. This is the most load-bearing concern because Theorem 3.1 is the paper's primary theoretical justification for claiming BiMarker improves detectability; Theorem 3.2 also inherits the convention issue through Eq. (1)'s centering. The paper's own text states the negative-pole behavior and the proof's formulas side by side, so this is an internal inconsistency, not a disagreement with external consensus. The empirical headline results are at gamma=0.5, where list1 and list2 have equal size and the mismatch disappears, which is consistent with the reader's CONDITIONAL verdict rather than a REJECT. I am not raising issues about missing code or error bars as the single load-bearing concern because those are reproducibility weaknesses, not direct threats to the validity of the stated theorem. The proposed check—recomputing Eq. (17) with the actual negative-pole green-list size, or simulating the inequality at gamma=0.25—directly settles whether Theorem 3.1 holds under the paper's own Algorithm 1. If it fails, the paper's theoretical contribution is reduced to the gamma=0.5 special case, and the general-gamma claims in Figure 3 and the text would need to be re-scoped.","tokens_in":18202,"tokens_out":1860,"duration_ms":15151,"concrete_test":"Re-derive the Theorem 3.1 lower bound for the negative pole using the actual Algorithm 1 definition: in the negative pole, green is list2 of size (1-gamma)|V|, so the green-token probability under logit boost to the red list is not gamma*alpha/(1+(alpha-1)*gamma) but needs recomputation with the (1-gamma) fraction boosted. Substitute that corrected bound into Eq. (15)-(17) and check whether B(|z|d)-B(|z|k) remains nonnegative for all gamma and alpha. A smaller numerical check: simulate the claimed inequality for gamma=0.25, Tp/Tn=(1-gamma)/gamma, alpha=exp(1.5) with the Algorithm 1 convention; if the difference becomes negative, Theorem 3.1's statement is false under the paper's own definitions.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central theoretical claim is that BiMarker's differential z-score has a strictly higher lower bound than KGW's (Theorem 3.1). This proof relies on Lemma A.1, which assumes the green list has size gamma|V|. However, Algorithm 1 defines the green list differently between polarities: in the positive pole list1 (size gamma|V|) is green, but in the negative pole list2 (size (1-gamma)|V|) is green. The proof in Appendix C.1 instead treats the negative pole as if its green list also has size gamma|V|: it bounds the negative-pole green-token count by gamma*Tn/(1+(alpha-1)*gamma), which is the Lemma A.1 bound for a green list of size gamma|V|, not for a green list of size (1-gamma)|V|. If the negative pole green list has size (1-gamma)|V|, the correct null mean and the correct green-token probability under the watermark differ, and the algebra in Eq. (17) collapses: the claimed nonnegative difference B(|z|d)-B(|z|k) is an artifact of mixing two incompatible conventions. The proof is therefore not a proof of Theorem 3.1 as stated for Algorithm 1. The experimental section mostly uses gamma=0.5, where the two list sizes coincide and the convention mismatch vanishes; this explains why empirical results at gamma=0.5 can look correct while the theorem as stated for general gamma remains unproven. This is not an external-consensus disagreement but an internal inconsistency between the method definition and the proof.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes BiMarker, a KGW-style watermarking method that alternates between two poles: in the positive pole the usual gamma-fraction green list is boosted, while in the negative pole the complementary list (size 1-gamma) is treated as green and the other list is boosted. Detection uses a differential z-score that compares green-token counts in the two poles. The paper claims that this differential statistic has a higher theoretical lower bound than KGW's z-score without increasing the false positive rate (Theorems 3.1 and 3.2), and it reports experiments on news-like text and code generation showing improved TPR at fixed FPR, especially at gamma=0.5, as well as compatibility with SWEET and EWD and preserved text quality (PPL, pass@1).","tokens_in":18456,"tokens_out":22659,"duration_ms":216213,"significance":"If the theoretical claims were correct, BiMarker would be a practically attractive, zero-overhead enhancement to KGW. The paper should be credited for clean empirical comparisons at gamma=0.5, quality checks (PPL and pass@1), robustness evaluation via back-translation, and for demonstrating that the bipolar construction can be combined with SWEET and EWD. However, the theoretical core is not established: the proof of Theorem 3.1 is inconsistent with Algorithm 1, the final algebra in the proof is incorrect for gamma != 0.5, the entropy-maximization step uses the wrong direction of convexity, and the proof of Theorem 3.2 contains formal errors. Since the theoretical analysis is presented as a main contribution and is used to explain the experimental gains, these issues are load-bearing.","major_comments":[{"comment":"The proof of Theorem 3.1 uses a negative-pole green-count bound that does not correspond to Algorithm 1. In Algorithm 1, when the polarity is negative, the green list is list2 of size (1-gamma)|V| and the logits of list1 (size gamma|V|) are boosted. Equation (14) instead bounds the expected negative-pole green count by gamma*Tn/(1+(alpha-1)*gamma), which is the value obtained when a green list of size gamma|V| is boosted. Under the Algorithm 1 convention, the negative-pole green probability in the uniform case is (1-gamma)*Tn/(1+(alpha-1)*gamma), which is larger than the proof's bound whenever gamma<0.5, and for non-uniform token distributions the discrepancy can be much larger. Therefore the lower bound in Eq. (15) is not a valid bound for the method defined in Algorithm 1.","section":"Appendix C.1, Eq. (14)"},{"comment":"Even under the proof's own convention, the final step '>= ... = 0' in Eq. (17) is algebraically valid only when gamma=0.5. The expression equals Tn*[1 - gamma*(alpha+1)/(1+(alpha-1)*gamma)] / sqrt(T*gamma*(1-gamma)), which is negative for gamma>0.5. Since Algorithm 1 and Theorem 3.1 allow any gamma in (0,1), the claim that BiMarker's lower bound 'consistently exceeds' KGW's lower bound is false as stated; at a minimum a condition such as gamma <= 0.5 would need to be stated and justified.","section":"Appendix C.1, Eqs. (16)-(17)"},{"comment":"The proof treats the uniform token distribution as the case that maximizes the negative-pole green count and uses it as an upper bound. This is backwards: for a fixed green-list size g, the green probability under red-list boosting is P_G/[1+(alpha-1)*(1-P_G)], which is convex in P_G for alpha>1. Jensen's inequality then implies that the uniform case gives a lower bound on the expected green probability, not an upper bound. Consequently, subtracting gamma*Tn/(1+(alpha-1)*gamma) in Eq. (14) is not conservative, and the argument cannot establish a lower bound on the differential z-score.","section":"Appendix C.1, paragraph before Eq. (14)"},{"comment":"The proof of Theorem 3.2 is not rigorous as written. Equation (21) is missing the density f(x) in the integrand and uses mu_Tn in the numerator where mu_Tp is required. Equation (22) then upper-bounds the integrand by the constant 1-Phi(t/sigma_T) and appears to integrate it over (-infinity, infinity), which diverges; the claim that 'x - gamma*Tn > 0' is not true on the entire integration range. The asserted relationship F_KGW >= F_Diff is therefore not established by the given argument.","section":"Appendix C.2, Eqs. (20)-(22)"},{"comment":"Under the iid model assumed in Theorem 3.1 with gamma=0.5 and Tp=Tn, the BiMarker differential statistic is exactly equivalent to the KGW statistic: the negative-pole green count can be written as T/2 minus a Binomial(T/2,p_p) variable, so G_p - G_n has the same distribution as KGW's G - T/2. Thus no strict improvement in the z-score distribution can arise in this model. The empirical gains in Table 1 and Figure 3 must therefore come from a mechanism not captured by Theorem 3.1 (for example, hard-coded polarity, null-mean misspecification, or non-iid text structure), and the paper should state and analyze that mechanism explicitly.","section":"Section 3.3, Table 1, Figure 3"}],"minor_comments":[{"comment":"The heading 'Movitation' should be 'Motivation', and the sentence 'Notably, our method consistently increases logits across gamma proportion of the vocabulary' is duplicated in Section 3.2; one copy should be removed.","section":"Section 3.1 and 3.2"},{"comment":"The main high-entropy experiments do not specify whether polarity assignment uses the pseudo-random rule of Algorithm 1 or the position-based hard-coded rule described later. This matters because random polarity makes Tp and Tn random, which changes the null variance of the statistic in Eq. (1).","section":"Section 4"},{"comment":"The column header 'B EST' is unclear and is presumably intended to be 'BEST'; please clarify.","section":"Table 2"},{"comment":"The symbol t is defined in Eq. (20) as z_threshold * sqrt(T*gamma*(1-gamma)) and then redefined in the EWD discussion; using distinct symbols would avoid confusion.","section":"Appendix C.2"},{"comment":"Langley (2000) appears in the bibliography but is not cited in the text, and Holtzman et al. (2019) is cited only in Appendix D.1; please clean up the citation list.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper fits the scope of a machine-learning or security venue, and the empirical study at gamma=0.5 is potentially useful. The main risk is the unsound theoretical core: Theorem 3.1 as stated appears false under the paper's own iid model, and Theorem 3.2's proof is not rigorous. If the authors can replace the theory with a correct statement about robustness to null-mean misspecification and align Algorithm 1 with the proof, the manuscript may become publishable; otherwise the theoretical claims should be removed or substantially weakened."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe thing to know: BiMarker's alternating-pole trick is genuinely new, and the gamma=0.5 experiments look credible, but the paper's central theorem—that BiMarker strictly beats KGW's z-score lower bound—is not proven as written. The proof in Appendix C.1 uses a different green-list convention from Algorithm 1. In the algorithm, the negative pole's green list is list2, size (1-γ)|V|. The proof bounds the negative-pole green count by γTn/(1+(α-1)γ), which is Lemma A.1's bound for a green list of size γ|V|. At γ=0.5 the two sizes coincide, which is why the experiments at 0.5 can look right while the general statement fails. This is an internal inconsistency, not a disagreement with prior work.\n\nWhat's actually good: The differential counting idea—splitting generation into two polarities and subtracting green counts—is a cheap new optimization axis. It requires no extra inference, no prompt access, and it composes with SWEET and EWD. The empirical effects at γ=0.5 (higher TPR at matched FPR, similar PPL and pass@1) are consistent with the claim. The motivation—human-text green counts vary and KGW's fixed expectation is crude—is sensible, and the correlation in Figure 2, though computed on a selected subset, points in the right direction.\n\nSoft spots, in order: (1) The theorem mismatch just described. (2) Theorem 3.2's proof has an invalid pointwise step: it asserts x - γTn > 0 inside an integral over all x, which isn't true, and the bound doesn't follow. (3) The correlation is on samples with human green count <120, so it's a conditional correlation, not a general one. (4) No code or error bars, and the appendix's hard-coded polarity cycles for code tasks are acknowledged to carry integrity risks. These are all fixable, but (1) and (2) mean the theoretical claims in the abstract and intro overstate what is established.\n\nWho this is for: researchers working on LLM watermark detection, specifically on low-strength, low-FPR regimes. A serious referee should look at this—the empirical core is credible and the idea is new enough to matter. My recommendation: send it to review, but with a referee who reads the appendix algebra. The authors should either fix the proof conventions or restrict the theorem to γ=0.5.","headline":"BiMarker's differential-counting idea and its gamma=0.5 experiments are genuinely worth a look, but the paper's central theorem is unproven as written because the proof and Algorithm 1 use different green-list conventions.","tokens_in":19106,"tokens_out":3176,"would_cite":true,"duration_ms":29574,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Splitting watermarked text into two oppositely-biased poles and comparing green-token counts between them gives a higher z-score lower bound than KGW at no extra false positives, the paper claims.","keywords":["LLM text watermarking","bipolar watermark","differential detection statistic","green-list logit boosting","false positive rate","KGW watermark","entropy-based detectors","watermark detection without prompt"],"falsifier":"Set $\\gamma=0.25$ (or any value away from 0.5) with $T_p/T_n = (1-\\gamma)/\\gamma$ and check two things. First, simulate the null by applying Algorithm 1's list partitions to thousands of genuinely non-watermarked sequences and estimate the empirical false-positive rate of the Eq. (1) statistic at a KGW-matched threshold; if the statistic is visibly off-center or the FPR exceeds KGW's, Theorem 3.2 fails under the algorithm's own convention. Second, recompute the Theorem 3.1 bound difference, Eqs. (16)-(17), substituting the algorithm's actual negative-pole green list of size $(1-\\gamma)|V|$ where the proof uses a list of size $\\gamma|V|$, and check whether $B(|z|_d) - B(|z|_k) \\geq 0$ still holds over the full range of spike-entropy values; if it turns negative for some values, the claimed strictly higher lower bound is not established.","tokens_in":17899,"feed_emoji":"⚖️","tokens_out":22595,"duration_ms":203279,"temperature":0.7,"pith_summary":"BiMarker attacks a weakness in the standard KGW watermark: its detector compares a text's green-token count against a fixed expected value $\\gamma T$, but real human-written text fluctuates around that value and tends to track the watermarked distribution, which blunts detection. The paper's fix is to mark each generation position as a positive or negative pole: in positive positions the green-list logits are boosted by $\\delta$ exactly as in KGW, while in negative positions the red-list logits are boosted instead. Detection then uses the difference between the two poles' green counts, so the unknown baseline of human text cancels within the text itself rather than being estimated from outside. The paper proves that this differential statistic has a higher theoretical lower bound than KGW's (Theorem 3.1) without raising the false-positive rate (Theorem 3.2), and reports higher true-positive rates at matched false-positive rates, with the largest gains at low watermark strength, while keeping text perplexity essentially unchanged because the same $\\gamma$ and $\\delta$ perturb the same share of the vocabulary. If the claims hold, the payoff is a free detection gain: better separation of AI text from human text with no added inference cost, no prompt access, and direct compatibility with entropy-based detectors such as SWEET and EWD.","feed_headline":"Splitting text into two poles sharpens LLM watermark detection","feed_subtitle":"Counting green tokens in each half of a text beats the standard fixed baseline, at no extra detection cost.","key_machinery":"The carrying object is the differential z-statistic over a bipolar partition of the text, along with the polarity-embedding rule in Algorithm 1. At each position the embedding assigns a polarity pseudo-randomly with probability $\\rho$ of being positive; in positive positions the green list (a random $\\gamma|V|$ subset of the vocabulary) has its logits raised by $\\delta$, and in negative positions the complementary red list is raised by $\\delta$, so the same $\\gamma$ share of the vocabulary is perturbed throughout and the token-level distribution change matches KGW. During detection, green tokens are counted within each pole and the statistic subtracts the null expectation $\\gamma T_p - (1-\\gamma) T_n$; at the ratio $T_p/T_n = (1-\\gamma)/\\gamma$ the statistic reduces to $(|s|^p_G - |s|^n_G)/\\sqrt{T\\gamma(1-\\gamma)}$. What does the work is the cancellation of the human-text baseline within the same piece of text, replacing KGW's fixed external reference $\\gamma T$, plus two supporting results: Theorem 3.1, which lower-bounds the watermarked z-score via the $\\alpha = \\exp(\\delta)$ boosting bound of Lemma A.1, and Theorem 3.2, which bounds the differential false-positive rate by the unipolar rate using Gaussian tail comparison. The same differential statistic is then applied, unchanged in structure, to the entropy-gated token set of SWEET and to the entropy-weighted terms of EWD.","core_discovery":"BiMarker is a watermarking scheme in which the generating rule itself supplies the baseline. The text is divided into positive and negative poles; the positive pole upweights a random $\\gamma|V|$ green list by $\\delta$, and the negative pole upweights the complementary red list by the same $\\delta$. The detector counts green tokens separately in each pole and forms the differential statistic $z = (|s|^p_G - |s|^n_G - \\gamma T_p + (1-\\gamma) T_n)/\\sqrt{T\\gamma(1-\\gamma)}$, which, when the pole sizes satisfy $T_p/T_n = (1-\\gamma)/\\gamma$, collapses to the bare difference of the two green counts divided by $\\sqrt{T\\gamma(1-\\gamma)}$; the null expectation is then zero for any human text regardless of its overall green tendency, and it is this cancellation that the paper identifies as the source of KGW's vulnerability to misestimating non-watermarked text. The paper's central claim is that the differential detector attains a higher theoretical lower bound on the z-score of watermarked text than KGW's single-pole statistic (Theorem 3.1, proved from the green-list probability bound of Lemma A.1), that it does not increase the false-positive rate over non-watermarked text (Theorem 3.2, by Gaussian tail comparison), and that both theorems survive when the differential scheme is layered onto the entropy-gated detector SWEET and the entropy-weighted detector EWD. Because embedding still boosts exactly a $\\gamma$ share of the vocabulary by the same $\\delta$, the induced change in the generated distribution matches KGW's, so the method is argued to preserve text quality while sharpening detectability.","pith_inferences":["Editorial extension: the cancellation trick should transfer to any watermark that biases a fixed vocabulary split, such as multi-color, semantic, or multi-bit green lists, because what BiMarker replaces is only the external null mean, not the KGW mechanism itself; this is testable by swapping the embedding while keeping the differential detector.","Editorial caveat: the proof of Theorem 3.1 bounds the negative pole's green count as if its green list had size $\\gamma|V|$, whereas Algorithm 1 defines the negative-pole green list as the complementary set of size $(1-\\gamma)|V|$; the two conventions coincide only at $\\gamma=0.5$, so a re-derivation of the bounds in the algorithm's own convention is the natural next step before relying on the exa","Editorial extension: the paper's motivation study reports a Pearson correlation of 0.7 between human and watermarked green-token counts; a stress test across other domains (multilingual text, dialogue, code) would show whether the differential gain shrinks when that correlation is weak.","Editorial extension: the hard-coded position-based polarity used with SWEET and EWD anchors the signal to absolute token positions, so insertions, deletions, or reordering that desynchronize the polarity clock could degrade the differential signal more than they degrade KGW's single-pole signal; the paper's limitations section concedes related fragility from adjacent-token dependencies in code."],"forward_implications":["At a matched false-positive budget, watermarked text is detected more often: at 1% FPR with $\\gamma=0.5$ and multinomial sampling, TPR rises from 0.436 to 0.498 at $\\delta=0.5$ and from 0.978 to 0.986 at $\\delta=1.5$.","The largest gains sit exactly where KGW is weakest, namely low watermark strength and strict (1% or zero) false-positive targets, so a practitioner can use a smaller $\\delta$ (less quality cost) for the same reliability.","Detection needs no prompt and no auxiliary language model: the within-text pole difference replaces the external $\\gamma T$ baseline, so the method applies when the prompt is unavailable and at the same computational cost as KGW.","Because embedding perturbs the same $\\gamma$ share of the vocabulary with the same $\\delta$, the text-quality impact equals KGW's, so the detection gain is argued to come without a generation-quality penalty.","The differential statistic composes with entropy-based optimizations: on code tasks, EWD with BiMarker reaches a best F1 of 0.96 on HumanEval versus 0.869 for EWD alone, with the paper's theorems stated to carry over to SWEET and EWD."],"supporting_citations":[{"why":"Supplies the KGW baseline: the red/green vocabulary partition, the delta logit boost, the single-pole z-score formula, and Lemmas A.1-A.2 (the green-token and perplexity bounds) from which Theorem 3.1 is derived.","marker":"(Kirchenbauer et al., 2023a)"},{"why":"SWEET, the entropy-thresholded watermark for code; supplies the low-entropy task setup, the entropy threshold, and the HumanEval benchmark onto which BiMarker is layered.","marker":"(Lee et al., 2024)"},{"why":"EWD, the entropy-weighted detection method whose weighted z-statistic BiMarker's differential form extends in the integration experiments.","marker":"(Lu et al., 2024)"},{"why":"Supplies the C4/RealNewsLike prompts and human completions used for the motivation study (Figure 2) and the high-entropy generation experiments.","marker":"(Raffel et al., 2020)"},{"why":"OPT-1.3B and OPT-2.7B, the models used to generate watermarked texts and to compute perplexity in the main experiments.","marker":"(Zhang et al., 2022)"}],"fun_headline_variants":["Two-pole split sharpens LLM watermark detection","BiMarker: bipolar green counts boost AI text detection","Differential poles improve LLM watermark detectability","Split text poles to sharpen LLM watermarking","Bipolar watermark: no extra cost, sharper detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is the detector's null model for human text, namely that the two poles' green-token counts are independent and centered at the differential expectation $\\gamma T_p - (1-\\gamma)T_n$, together with one consistent definition of the negative pole's 'green list' across the algorithm, the statistic, and the proof; the paper's algorithm and its proof use different definitions of that list whenever $\\gamma \\neq 0.5$, so the false-positive guarantee is clean only where the two conventions coincide.","fun_headline_variants_meta":{"raw":{"variants":["Two-pole split sharpens LLM watermark detection","BiMarker: bipolar green counts boost AI text detection","Differential poles improve LLM watermark detectability","Split text poles to sharpen LLM watermarking","Bipolar watermark: no extra cost, sharper detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000215,"raw_usage":{"total_tokens":1458,"prompt_tokens":1003,"completion_tokens":455,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":619,"completion_tokens_details":{"reasoning_tokens":381}},"tokens_in":619,"tokens_out":455,"duration_ms":5238,"temperature":1.0,"reasoning_tokens":381,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T17:28:20.763389+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Set $\\gamma=0.25$ (or any value away from 0.5) with $T_p/T_n = (1-\\gamma)/\\gamma$ and check two things. First, simulate the null by applying Algorithm 1's list partitions to thousands of genuinely non-watermarked sequences and estimate the empirical false-positive rate of the Eq. (1) statistic at a KGW-matched threshold; if the statistic is visibly off-center or the FPR exceeds KGW's, Theorem 3.2 fails under the algorithm's own convention. Second, recompute the Theorem 3.1 bound difference, Eqs. (16)-(17), substituting the algorithm's actual negative-pole green list of size $(1-\\gamma)|V|$ where the proof uses a list of size $\\gamma|V|$, and check whether $B(|z|_d) - B(|z|_k) \\geq 0$ still holds over the full range of spike-entropy values; if it turns negative for some values, the claimed strictly higher lower bound is not established.","supporting_citations":[{"cited_title":"Who wrote this code? watermarking for code generation","cited_arxiv_id":null,"evidence_quote":"SWEET, the entropy-thresholded watermark for code; supplies the low-entropy task setup, the entropy threshold, and the HumanEval benchmark onto which BiMarker is layered."}],"review_version":1}