REVIEW 4 major objections 6 minor 22 references
Modification and Generated-Text Detection: Achieving Dual Detection Capabilities for the Outputs of LLM by Watermark
T0 review · 4 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read One watermarking replay can flag both that a text is machine-generated and that it was later edited, by counting tokens that no longer match the generation-time sample.
desk verdict A plausible dual-detection scheme for δ-reweight watermarks, but the central separation is under-supported by an undisclosed threshold and a replay that shows nonzero false positives on unmodified text. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the discarded token: a text token that fails to match the token obtained by replaying δ-reweight sampling with the same secret key and context window. The context window is short — the most recent five tokens — so one edited token typically distorts the next several samples and creates a contiguous burst of discarded tokens. IDD accumulates this binary mismatch count and compares it with a threshold; drLLR removes the mismatching positions by assigning them score zero and divides the sum of the remaining log-likelihood-ratio scores by total length. The same replay loop therefore supplies both a tamper flag and a watermark-confidence score.
What would settle it
Generate a δ-reweight watermarked sentence, then edit one early token by replacing it with the exact token the replayed sampler would choose under the edited context. If many such collisions keep the discarded-token count below the modification threshold, IDD will miss the edit. A concrete run: build 30-token watermarked outputs, apply one-token replacements chosen to match the new context, and measure the discarded-token distribution; a large overlap with the unmodified distribution would settle the matter.
Extended reading notes
Core claim
The core claim is that δ-reweight watermark's sensitivity to context, normally treated as a robustness weakness, is itself a useful tamper signal. Under δ-reweight, one sampled token is forced to probability 1 for each position, so at detection time a token either matches the replayed sample exactly or it does not. A modification in the context changes the seeds for subsequent positions, so the replayed sampler diverges and the affected tokens become discarded tokens that cannot count toward the watermark. The proposed IDD method counts those discarded tokens and raises a modification flag when the count exceeds a threshold, while the proposed drLLR score assigns a score of zero to discarded tokens and averages the rest. In the paper's low-entropy experiments with a 6.7B-parameter model on a biomedical question-answering test set, IDD reports near-perfect modification detection for single-word additions, deletions, and replacements, and drLLR keeps generated-text detection area-under-the-Curve (AUC) above roughly 0.94 at 10% token modification.
Load-bearing premise
The method assumes the detector can replay the exact generation-time δ-reweight sampling—same model, same secret key, same five-token context window, same sampling parameters—and that any edit worth detecting changes at least one subsequent sampled token so it no longer matches the text.
Editorial extensions
If this is right
- A service provider can run a single detector that simultaneously reports whether text carries its watermark and whether the text has been altered, without training a separate tamper-detection model.
- Tiny edits that preserve fluency, such as changing one word in a 30-token answer, are exactly the cases where a robust watermark stays intact; this method converts those edits into a detectable burst of discarded tokens.
- Generated-text detection becomes more robust than the original maximin log-likelihood-ratio score (mmLLR): at 10% token modification the reported AUC stays around 0.94–0.95, while the original score falls to roughly 0.66–0.68.
- The dual signal is a trade-off: the same sensitivity that makes edits visible also limits the watermark's robustness to heavy rewriting, so the method is best suited to detecting light tampering rather than paraphrase attacks.
Reading between the lines
- A deployed version of this scheme would need to handle benign editing explicitly, since any edit that shifts more than a few tokens could trigger the modification flag; the paper's threshold is fixed rather than calibrated on a per-domain expected edit rate.
- The positions of discarded tokens could be used as coarse localization of where the edit happened, something the paper does not pursue: the first mismatch marks the start of the disturbance and the run length reveals how far the change propagated.
- The detection guarantee relies on the detector replaying generation exactly; for an outside party without the secret key and hyperparameters the method does not apply, so the realistic scenario is a provider-side verifier rather than public verification.
- One natural stress test is an adversarial edit that replaces a word with exactly the token the replayed sampler would choose under the new context; the paper does not analyze how often such collisions occur.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a dual-detection watermarking framework for LLM outputs built on the δ-reweight unbiased watermark of Hu et al. The first component, Inconsistent Diffusion Detection (IDD), counts 'inconsistent tokens'—positions where a replayed δ-reweight sampling of the submitted text differs from the submitted token—and uses that count (normalized by the context length nct) to decide whether the text has been modified. The second component, drLLR, modifies the LLR watermark score by dropping inconsistent tokens, so that generated-text detection remains possible after modification. Experiments on PubMedQA prompts with OPT-6.7B, 30-token outputs, and addition/deletion/replacement perturbations at 10% and 20% strength report high TPR/F1 for modification detection and AUC values for generated-text detection, supporting the claim of dual detection in this setting.
Significance. If validated, the paper would address a real and under-studied problem: robust watermarks can be preserved after an edit, allowing harmful modified text to be falsely attributed to an LLM provider. The discarded-token/inconsistent-token idea is simple and intuitive, and the drLLR modification appears to give a substantial AUC improvement over the original mmLLR in the tested low-entropy setting. The paper explicitly proposes a new metric (inconsistent tokens) and a new detection score (drLLR), and it includes experiments on a realistic medical Q&A dataset. However, the empirical support is currently preliminary: the key decision threshold is undisclosed, the exact-replay premise is not verified, and the evaluation is a single 30-token setting with no variance estimates. The contribution is potentially useful but requires substantial additional evidence before the dual-detection claim can be accepted.
major comments (4)
- [Section 3.4, Algorithm 1, Table 2] The modification threshold MT is never disclosed, and Table 2's TPR/FPR values are therefore uninterpretable without it. The decision rule in Algorithm 1 is nit/nct > MT, so both MT and the normalization constant nct affect every reported operating point. To make the results reproducible, the paper must report the exact MT used for each row, the calibration procedure, and ideally the full ROC curve or AUC for modification detection rather than a single operating point.
- [Section 3.3, Algorithm 1, Table 2] The core premise is that the detector can replay the exact generation-time δ-reweight sampling, but the paper's own Table 2 reports nonzero FPR (0.003–0.010) on unmodified watermarked text. If the replay were exact, nit would be zero for all unmodified texts and any positive MT would give FPR = 0. The nonzero FPR means either the replay is not exact (for example, the prompt or secret key is missing from Algorithm 1's input list, or Top-p/Top-k sampling is not reproduced) or MT is chosen so that some positive nit values are accepted as modified. Either way, the claimed clean separation between modified and unmodified text is not established. Please report the distribution of nit on unmodified text, explain every nonzero case, and specify how the prompt, key, and sampling hyperparameters are supplied to the detector.
- [Section 4.1, Table 2, Figure 3] The evaluation is restricted to one model (OPT-6.7B), one dataset (PubMedQA), one output length (30 tokens), and one low-entropy regime, with no error bars or multiple seeds. This is insufficient to support the paper's claim that IDD detects 'any tiny modification.' In particular, a single-token edit at the last position gives nit/nct = 0.2 under nct = 5, which may fall below any MT that keeps FPR low. Please report detection rate as a function of edit position and edit strength, include at least three independent seeds, and provide confidence intervals for the TPR/FPR and AUC values.
- [Sections 3.2–3.4] The paper assumes that any relevant modification will produce at least one inconsistent token in the replay, but this is not proven or tested. If an edit replaces a token with the token that the replayed sampler would have chosen under the modified context, nit can remain zero and the modification is invisible to IDD. Please add a concrete experiment that forces such matched replacements, or provide a theoretical bound on the probability that a single-token edit changes the replayed token as a function of the entropy of the distribution and the context length nct. Without this, the method's sensitivity to 'any tiny modification' remains an unsupported assertion.
minor comments (6)
- [Section 4.1] The 'random perturbation parameter ϵ' is not precisely defined: are modified positions chosen uniformly at random, are additions/deletions token-level or word-level, and how is the text length kept fixed for deletion and addition attacks?
- [Algorithm 1 and Section 3.5] Algorithm 1 uses drLLR/n for the average score, while Eq. (4) writes 1/N Σ drLLR(xi); please align the notation (n vs N) and clarify whether the denominator is the total number of tokens including inconsistent ones.
- [Section 3.4, Eq. (2)] The summation notation in Eq. (2) is malformed (it reads 'N X i=1'), and the symbol xi is overloaded: it denotes both the token in the submitted text and the token sampled by the replay. Please use distinct symbols for clarity.
- [References] References [18], [19], and [22] are described as 'unpublished' in the body text, but they are available as arXiv papers or published conference papers; please cite the published versions.
- [Throughout] There are several typographical errors, including 'T EXT' in the title, 'δ-rewight' in Section 3.3, and 'orignal' in Section 4.4.
- [Figure 3] The axes of Figure 3 are not described in the caption; please add axis labels and a clear explanation of what is plotted so the reader can interpret the distribution of discarded tokens.
Circularity Check
No load-bearing circularity: the modification detection statistic is defined operationally and validated against independently defined edits; the undisclosed threshold and imperfect replay are reproducibility concerns, not circular reductions.
full rationale
The paper does not derive a prediction from a fitted input or from a self-citation chain. IDD (Algorithm 1, Sections 3.3-3.4) counts tokens for which a replayed δ-reweight sample differs from the submitted text (Eqs. 1-2); the claim that this count signals modification is an empirical causal claim, since an edit can in principle fall outside the nct influence window or coincide with the replayed sample, so the relation is not definitional. drLLR (Eq. 3) is a standard LLR with -inf terms replaced by zero, and it is evaluated threshold-independently via AUC in Table 3. The paper's references to δ-reweight [17] and KGW [11] are external prior work, not self-citations, and no uniqueness theorem is imported from the authors' own publications. Two caveats lower confidence without constituting circularity: the threshold MT is an input to Algorithm 1 but is never disclosed nor its calibration described, so the TPR/FPR operating points in Table 2 are under-specified; and the nonzero FPR on unmodified watermarked text in Table 2 shows the replay is not perfectly clean, so the assertion that unmodified text gives nit=0 by construction is not satisfied empirically. These are reproducibility and validity concerns, not a reduction of the claimed result to its own inputs.
Assumptions & free parameters
free parameters (2)
- Modification threshold MT =
not reported
- Context window length nct =
5 (default from δ-reweight)
assumptions (3)
- domain assumption Detector can replay the exact generation-time δ-reweight sampling, including the same LLM, secret key, nct, and sampling parameters.
- ad hoc to paper Any relevant modification changes at least one context window so that the replayed sample no longer matches the text token.
- standard math δ-reweight sampling is unbiased and deterministic given key and context.
Cite this review
Pith. "Pith review of Modification and Generated-Text Detection: Achieving Dual Detection Capabilities for the Outputs of LLM by Watermark." pith.science (2026). https://pith.science/paper/NYQYHZ4O
@misc{pith2026250208332,
author = {Pith},
title = {Pith review of: Modification and Generated-Text Detection: Achieving Dual Detection Capabilities for the Outputs of LLM by Watermark},
year = {2026},
howpublished = {\url{https://pith.science/paper/NYQYHZ4O}},
note = {Machine review of arXiv:2502.08332}
}
read the original abstract
The development of large language models (LLMs) has raised concerns about potential misuse. One practical solution is to embed a watermark in the text, allowing ownership verification through watermark extraction. Existing methods primarily focus on defending against modification attacks, often neglecting other spoofing attacks. For example, attackers can alter the watermarked text to produce harmful content without compromising the presence of the watermark, which could lead to false attribution of this malicious content to the LLM. This situation poses a serious threat to the LLMs service providers and highlights the significance of achieving modification detection and generated-text detection simultaneously. Therefore, we propose a technique to detect modifications in text for unbiased watermark which is sensitive to modification. We introduce a new metric called ``discarded tokens", which measures the number of tokens not included in watermark detection. When a modification occurs, this metric changes and can serve as evidence of the modification. Additionally, we improve the watermark detection process and introduce a novel method for unbiased watermark. Our experiments demonstrate that we can achieve effective dual detection capabilities: modification detection and generated-text detection by watermark.
Figures
Reference graph
Works this paper leans on
-
[1]
On the risk of misinformation pollution with large language models
Yikang Pan, Liangming Pan, Wenhu Chen, Preslav Nakov, Min-Yen Kan, and willian Wang. On the risk of misinformation pollution with large language models. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023 , pages 1389–1403. Association for Computational Linguistics, 2023
work page 2023
-
[2]
When llms go online: The emerging threat of web-enabled llms
Hanna Kim, Minkyoo Song, Seung Ho Na, Seungwon Shin, and Kimin Lee. When llms go online: The emerging threat of web-enabled llms. arXiv preprint arXiv:2410.14569, 2024
arXiv 2024
-
[3]
Position: On the possibilities of AI-generated text detection
Souradip Chakraborty, Amrit Bedi, Sicheng Zhu, Bang An, Dinesh Manocha, and Furong Huang. Position: On the possibilities of AI-generated text detection. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp, editors, Proceedings of the 41st International Conference on Machine Learning,...
work page 2024
-
[4]
Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D. Manning, and Chelsea Finn. Detectgpt: zero- shot machine-generated text detection using probability curvature. In Proceedings of the 40th International Conference on Machine Learning, ICML’23. JMLR.org, 2023
work page 2023
-
[5]
On the reliability of watermarks for large language models
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. On the reliability of watermarks for large language models. arXiv preprint arXiv:2306.04634, 2023
arXiv 2023
-
[6]
Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie J Su. A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules. arXiv preprint arXiv:2404.01245, 2024
work page Pith review arXiv 2024
-
[7]
Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Derek F. Wong, and Lidia S. Chao. A survey on llm-generated text detection: Necessity, methods, and future directions. arXiv preprint arXiv:2310.14724, 2023
arXiv 2023
-
[8]
A review of text watermarking: Theory, methods, and applications
Nurul Shamimi Kamaruddin, Amirrudin Kamsin, Lip Yee Por, and Hameedur Rahman. A review of text watermarking: Theory, methods, and applications. IEEE Access, 6:8011–8028, 2018. Conference Name: IEEE Access
work page 2018
Show all 22 references
-
[9]
Advancing beyond identification: Multi-bit watermark for large language models
KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit watermark for large language models. In Kevin Duh, Helena Gomez, and Steven Bethard, editors, Proceedings of the 2024 Conference of the North American Chapter of the Association for Computation...
2024
-
[10]
Tracing text provenance via context-aware lexical substitution
Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma, Feng Wang, and Nenghai Yu. Tracing text provenance via context-aware lexical substitution. InProceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 11613–11621, 2022
2022
-
[11]
A watermark for large language models
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors, Proceedings of the 40th Internat...
2023
-
[12]
Provable robust watermarking for AI-generated text
Xuandong Zhao, Prabhanjan Vijendra Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for AI-generated text. In The Twelfth International Conference on Learning Representations, 2024
2024
-
[13]
Who wrote this code? watermarking for code generation
Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, 8 A PREPRINT - MARCH 4, 2025 editors, Proceedings of the 62nd Annual...
2025
-
[14]
A resilient and accessible distribution-preserving watermark for large language models
Yihan Wu, Zhengmian Hu, Junfeng Guo, Hongyang Zhang, and Heng Huang. A resilient and accessible distribution-preserving watermark for large language models. In Forty-first International Conference on Machine Learning, 2024
2024
-
[15]
Robust distortion-free watermarks for language models
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. Transactions on Machine Learning Research, 2024
2024
-
[16]
Undetectable watermarks for language models
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In Shipra Agrawal and Aaron Roth, editors, Proceedings of Thirty Seventh Conference on Learning Theory, volume 247 of Proceedings of Machine Learning Research, pages 1125–1139. PMLR, 30 Jun–03...
2024
-
[17]
Unbiased watermark for large language models
Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. In The Twelfth International Conference on Learning Representations, 2024
2024
-
[18]
No free lunch in llm watermarking: Trade-offs in watermarking design choices
Pang Qi, Hu Shengyuan, Zheng Wenting, and Smith Virginia. No free lunch in llm watermarking: Trade-offs in watermarking design choices. arXiv preprint arXiv:2402.16187, 2024
2024 arXiv
-
[19]
Discovering clues of spoofed lm watermarks
Thibaud Gloaguen, Nikola Jovanovi ´c, Robin Staab, and Martin Vechev. Discovering clues of spoofed lm watermarks. arXiv preprint arXiv:2410.02693, 2024
2024 arXiv
-
[20]
New evaluation metrics capture quality degradation due to llm watermarking, 2023
Karanpartap Singh and James Zou. New evaluation metrics capture quality degradation due to llm watermarking, 2023
2023
-
[21]
Pubmedqa: A dataset for biomedical research question answering
Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William Cohen, and Xinghua Lu. Pubmedqa: A dataset for biomedical research question answering. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natur...
2019
-
[22]
Opt: Open pre-trained transformer language models
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068, 2022. 9
2022 arXiv
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.