Pith. sign in

REVIEW 4 major objections 6 minor 38 references

Sandcastles in the Storm: Revisiting the (Im)possibility of Strong Watermarking

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Random-walk attacks remove AI text watermarks only about 10% of the time once humans verify quality.

desk verdict A serious empirical challenge to the WITS impossibility result that deserves referee time, but the slow-mixing claim is not yet proven and needs calibration work. read the letter →

arxiv 2505.06827 v1 pith:QACEWYLH submitted 2025-05-11 cs.CR cs.AI

Fabrice Y Harel-Canada , Boran Erol , Connor Choi , Jason Liu , Gary Jiarui Song , Nanyun Peng , Amit Sahai This is my paper · ORCID
classification cs.CRcs.AI
keywords AItextwatermarkingrandom-walkattacksmixingtimequalityoraclesLLMwatermarkrobustnesshumanevaluationperturbationimpossibilityresult
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Recent theory on 'watermarking in the sand' says any text watermark can be erased by a random walk of small quality-preserving edits, provided the walk mixes rapidly and an automated quality oracle guides it reliably. This paper tests both assumptions across three watermarking schemes and seven perturbation operators, and finds both fail in practice. Perturbed texts remain traceable to their starting text 100% of the time after hundreds of edits; the best automated quality oracle still misclassifies about one edit in five; and the average attack removes the watermark 26.1% of the time, dropping to 10.5% when human reviewers first confirm that text quality was actually preserved. If these results hold, the practical force of the theoretical impossibility result is much weaker than it looks, and watermarking remains a viable defense until attackers can mix text faster or judge quality better.

What carries the argument

The argument is carried by an empirical stand-in for the formal random-walk object: the graph $G^{\ge q}_x$ of high-quality responses to a prompt, whose edges are weighted by a perturbation oracle $\mathcal{P}$ and filtered by a quality threshold $q$. Instead of measuring the spectral gap (infeasible at this graph size), the paper uses a lineage distinguisher—an LLM shown two candidate starting texts and a mutated text, asked to name the origin—on the premise that a well-mixed walk should make this choice no better than chance. It also builds the Sandcastles benchmark, 795 human-annotated perturbations, to score how reliably automated oracles preserve quality, and then runs full attacks on KGW, SIR, and Adaptive watermarks guided by the best locally hosted oracle. The pivotal numbers are ASRfin, the fraction of attacks that push the detection score below the unwatermarked threshold, and Q-ASRfin, the same fraction after human adjudication that quality was preserved.

What would settle it

Take a text-perturbation chain small enough to compute its actual mixing time (or with a known fast-mixing transition operator), run the paper's lineage distinguisher on samples drawn before and after that mixing time, and check whether traceability falls to chance once the chain has mixed; if it does not, the distinguisher is not a valid proxy for slow mixing, and the KA1 refutation collapses.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the two assumptions behind the WITS impossibility theorem—rapid mixing and reliable quality guidance—do not hold for the watermarks, mutators, and oracles tested. A lineage distinguisher built from Llama-3.1-70B with escalation to GPT-4o and o3-mini-high correctly identified the origin of every one of 4,555 perturbed texts, including after 500 sentence-level mutations, so the random walks never lost memory of their starting points. The best automated quality oracle, a fine-tuned GPT-4o, reached an F1 score of 77.4%, meaning nearly one edit in five was misjudged. Final attack success averaged 26.1% across perturbation strategies; after human reviewers filtered out degraded outputs, the quality-controlled success rate fell to 10.5%, and no fairly evaluated attack succeeded more than half the time. The paper concludes that slow mixing and imperfect quality control make watermarking far harder to remove than the theoretical model suggests.

Load-bearing premise

The conclusion that mixing is slow rests on treating an LLM's ability to trace a mutated text back to one of two originals, in 100% of tests, as evidence that the random walk has not approached its stationary distribution; the paper never directly measures the mixing time or calibrates the distinguisher against the formal definition.

Editorial extensions

If this is right

  • For the tested watermarking schemes, a random-walk attack is not the near-certain eraser the impossibility theorem describes: an attacker must either accept a low success rate or tolerate text that human readers judge degraded.
  • Watermark designs can exploit the measured asymmetry: Adaptive, which concentrates its signal in high-entropy tokens, held every word-level and entropy-word attack to 0% quality-controlled success.
  • Attack evaluations that omit human quality review will overstate success substantially; in this study the average success rate fell by 59.52% when human review was added.
  • Theoretical attack models should treat the quality oracle as a fallible component whose errors compound over many steps rather than as a perfect gate.
  • Automated quality metrics that reward surface fluency can improve even as human-judged quality drops, so they are not a reliable substitute for human evaluation in watermark attack studies.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the slow-mixing evidence was collected with local, token-to-sentence-scale mutators, a mutator that makes large, context-aware jumps between stylistic regions could mix faster and partially restore the WITS-style impossibility; the paper's own discussion of disconnected 'islands' of high-quality text suggests this route is open.
  • The lineage distinguisher could be reused as a forensic audit tool: if 100% traceability holds after hundreds of edits, even heavily rewritten text may carry recoverable provenance signals.
  • If quality-preserving text does form disconnected islands, watermark designers could deliberately steer watermarked outputs toward isolated regions of the text space, turning a theoretical vulnerability into a structural defense.
  • The reversal of 'verification is easier than generation' implies that improvements in automated quality judgment—better reward models or reasoning models—are the key variable that would decide whether the theoretical attack ever becomes practical.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper empirically tests two assumptions behind the random-walk watermark-removal attack of Zhang et al. (WITS): KA1, that the perturbation chain mixes rapidly, and KA2, that an automated quality oracle reliably guides edits. Using three watermarking schemes (KGW, SIR, Adaptive), seven perturbation oracles, a forced-choice lineage distinguisher, and human quality annotations, the paper reports three main findings: (i) 100% of 4,555 lineage tests remain traceable after hundreds of perturbations, interpreted as slow mixing; (ii) the best quality oracle attains an overall F1 of only 77.4%; and (iii) average final attack success is 26.1%, dropping to 10.5% after human quality review. The paper concludes that practical barriers make watermarking far more robust than the WITS impossibility result suggests.

Significance. If the empirical conclusions hold, the paper is a useful practical counterpoint to WITS-style mixing-time theory, and it contributes the Sandcastles human-annotated perturbation dataset plus a systematic oracle benchmark. The RQ3 measurements are concrete and falsifiable, and the human-review correction of ASR is a valuable step beyond prior evaluations. However, the RQ1 inference from the lineage distinguisher to formal mixing time is uncalibrated, and Table 3 appears to swap the SIR and KGW labels; as a result, the per-scheme quantitative claims need correction before the paper's central narrative can be fully accepted.

major comments (4)
  1. [§4.1, Definition 2.1] The lineage distinguisher is used as a proxy for the formal ε_dist-mixing time of Definition 2.1, but it is never calibrated against a known-mixed baseline, against independent unlinked texts, or against samples drawn from a stationary distribution. Perfect forced-choice traceability of a perturbed text to one of two starting texts does not by itself imply that total-variation distance to stationarity is large: a classifier can achieve high accuracy from content or style priors, from leakage in prompt construction, or from persistent topic cues, as the NASA/Artemis example in Appendix C.1 illustrates. Moreover, the paper's own Section 5 'islands' argument predicts persistent traceability when irreducibility fails, which is a different failure from slow mixing within an irreducible chain. Without an estimate of the spectral gap or mixing time, or at least a control with texts that have no causal lineage to either starting point, the conclusion that 'mixing is slow and KA1 is contradicted' is not established.
  2. [Table 3 vs. Table 5 / Appendix B.3] The SIR and KGW rows appear to be swapped between Table 3 and Table 5. Table 5 reports the SIR watermarked mean as 0.28 and the KGW mean as 5.32, while Table 3 assigns µw0=5.32 and breakpoint 1.27 to rows labeled SIR and µw0=0.28 and breakpoint 0.21 to rows labeled KGW. Because SIR and KGW have different detection-score scales and the paper draws per-scheme conclusions (for example, 'SIR Sentence Q-ASRfin=48.56' and 'Adaptive remains resistant'), this label swap affects load-bearing per-watermark claims and must be corrected, with all dependent statements re-checked.
  3. [§4.2–§4.3, Definition A.5] The attack filters candidate mutations with InternLMOracle using a relative acceptance rule — a score within a 0.46 deviation of the original text — not the absolute quality threshold q on Q(x,y) that defines the WITS graph G≥q_x. Consequently, the executed random walk is not necessarily the same walk whose stationary distribution the WITS theorem analyzes, and the low ASR and Q-ASR figures may reflect this mismatch plus oracle errors rather than a failure of the theoretical attack. The paper should either instantiate a WITS-style absolute-threshold acceptance rule or explicitly argue that the relative rule is the intended practical version of KA2, and it should state how the 0.46 threshold was chosen.
  4. [§5 / §4.1] Section 5 argues that reducibility may fail because of high-quality 'islands,' which would prevent convergence to a unique stationary distribution altogether. The RQ1 traceability result is therefore ambiguous between two different explanations — slow mixing in an irreducible chain versus non-irreducibility — and cannot by itself 'contradict KA1' without separating these cases. A concrete test would be to start multiple walks from texts within the same apparent component and measure whether traceability to arbitrary starts decays, or to estimate a lower bound on the spectral gap for a manageable subgraph; the paper currently provides neither.
minor comments (6)
  1. [§4.1, Table 1] Each reported test aggregates roughly ten autocorrelated samples from one walk and fails if any single sample is misclassified; please report per-sample accuracy and test-level confidence intervals in addition to the 100% over 4,555 tests.
  2. [Table 3 and Table 13] The Q-ASRfin estimates are based on very small human-review counts, sometimes 0, 1, or 2 reviewed texts per row; please report confidence intervals or exact binomial intervals so the reader can see the uncertainty around figures such as 'no fairly evaluated attack succeeding more than half the time.'
  3. [§4.2, Table 2] The text describes the top oracle's performance as '77% accuracy,' but Table 2 reports Overall F1; please use F1 consistently to avoid conflating precision, recall, and accuracy.
  4. [Table 5, Table 13] There are typos in the table headers: 'Watermarkered' should be 'Watermarked' and 'autoamated' should be 'automated.'
  5. [§4.2] The statement that 'the best floating-point oracle' is InternLMOracle is not fully justified in the main text; the selection from the 150-step human comparison is only described in Appendix E.4, so please summarize the selection criterion and its uncertainty in the main body.
  6. [§4.3] The attack-success criterion of being below µuw + 2σuw is reasonable but arbitrary; the threshold-sensitivity figures in Appendix G.1 are helpful, and the main text should state that the headline ASR numbers use the 2σ operating point.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline attack-success and oracle-accuracy numbers are empirical measurements against external watermarking schemes and human judgments, not outputs of a derivation that reduces to its inputs; the RQ1 mixing inference is an uncalibrated proxy but that is a validity concern, not circularity.

full rationale

The paper does not derive its central results by construction from its own assumptions. The RQ3 attack-success rates (ASR_fin and Q-ASR_fin) are measured outcomes: watermarked texts are produced by publicly defined schemes (KGW, SIR, Adaptive), attacked with externally specified mutators, and judged by detector thresholds computed from unwatermarked baseline texts. The human-review correction is an independent measurement on a sample of successful attacks, and although the sample sizes are small, the calculation Q-ASR_fin = ASR_fin × (QP/Reviewed) is an adjustment, not a fitted parameter later relabeled as a prediction. The RQ2 oracle-reliability result is a benchmark against the authors' own human annotations; using the best-scoring oracle to guide attacks is an implementation choice, and the conclusion that attacks underperform does not presuppose that oracle failure. The one place where a theoretical claim is inferred rather than measured is RQ1: the paper equates 100% lineage distinguishability with failure to mix, without calibrating the distinguisher against a known-mixed distribution or estimating the spectral gap. That is an empirical-validity gap, not a circular reduction: Definition 2.1 (mixing time) is imported from Zhang et al. and is independent of the distinguisher, and the paper does not define mixing as traceability. There are no load-bearing self-citations, and no prediction is forced by a fitted input. Accordingly, the paper is not circular; concerns about the RQ1 proxy belong under correctness risk, not circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central empirical claims rest on a series of assumptions about the representativeness of the tested watermarkers and attacks, and about the validity of the measurement proxies. The free parameters are thresholds and hyperparameters tuned by the authors; the axioms include the WITS framework itself and the unproven equivalence between origin traceability and slow mixing. No new physical or conceptual entities are introduced.

free parameters (4)
  • InternLMOracle acceptance threshold = 0.46 score deviation from original
    Edits are accepted only if InternLMOracle's score stays within 0.46 of the original text. This threshold was chosen based on a pilot comparing oracles with human judgments (Appendix E.4). It directly controls the number of accepted perturbations and hence the measured ASR.
  • Adaptive watermark hyperparameters = alpha=2.0, delta=1.5, delta_0=1.0
    The authors tuned Adaptive's hyperparameters after noting 'initially poor results' (Appendix B.1). These settings determine the watermark strength and quality of the watermarked texts, affecting how easy they are to attack.
  • Perturbation step budgets = 1000 (token-level), 250 (span), 150 (sentence), 100 (document-level)
    The number of allowed mutation steps was chosen by the authors 'to maximize the opportunity for watermark removal' (Section 3). If mixing is slow but not absent, larger budgets could eventually reach the stationary distribution; the chosen budgets bound the measured success.
  • Watermark detection breakpoint = mu_uw + 2*sigma_uw
    An attack is declared successful when the final detection score falls below two standard deviations above the unwatermarked mean. This is a standard convention but a modeling choice; the threshold-ASR plots (Appendix G.1) show results are sensitive to it.
assumptions (5)
  • ad hoc to paper The lineage distinguisher test is a valid proxy for mixing time.
    Section 4.1 concludes KA1 is contradicted because a classifier can trace the origin in 100% of tests, but no formal link is provided between origin traceability and the spectral-gap-based mixing time (Definition 2.1).
  • domain assumption The tested perturbation oracles satisfy WITS's epsilon_pert-preserving condition.
    The WITS theorem (Theorem 1) requires P to be epsilon_pert-preserving. The paper measures approval rates (Table 6) but never verifies the full Definition A.1 condition; if some mutators fail it, the attack comparison to the theorem is not exact.
  • ad hoc to paper The InternLMOracle score threshold q=0.46 defines WITS's quality threshold q.
    The theory is parameterized by an arbitrary quality function Q and threshold q. The paper instantiates Q with InternLMOracle and a 0.46 deviation threshold chosen in a pilot (Appendix E.4); the measured ASR depends on this choice.
  • domain assumption Human quality judgments are the ground truth for quality preservation.
    The paper uses human annotations (including coauthors for the Sandcastles dataset) to define 'quality preserved'. It is a reasonable assumption but the annotator pool is small and the authors list this as a limitation.
  • domain assumption The WITS formalism (Definitions A.1-A.8, Theorem 1) is taken as correct prior work.
    The paper builds directly on the WITS definitions and theorem; it does not re-derive them. This is cited background, but the validity of the WITS theorem itself is assumed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Sandcastles in the Storm: Revisiting the (Im)possibility of Strong Watermarking." pith.science (2026). https://pith.science/paper/QACEWYLH

@misc{pith2026250506827,
  author       = {Pith},
  title        = {Pith review of: Sandcastles in the Storm: Revisiting the (Im)possibility of Strong Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QACEWYLH}},
  note         = {Machine review of arXiv:2505.06827}
}
read the original abstract

Watermarking AI-generated text is critical for combating misuse. Yet recent theoretical work argues that any watermark can be erased via random walk attacks that perturb text while preserving quality. However, such attacks rely on two key assumptions: (1) rapid mixing (watermarks dissolve quickly under perturbations) and (2) reliable quality preservation (automated quality oracles perfectly guide edits). Through large-scale experiments and human-validated assessments, we find mixing is slow: 100% of perturbed texts retain traces of their origin after hundreds of edits, defying rapid mixing. Oracles falter, as state-of-the-art quality detectors misjudge edits (77% accuracy), compounding errors during attacks. Ultimately, attacks underperform: automated walks remove watermarks just 26% of the time -- dropping to 10% under human quality review. These findings challenge the inevitability of watermark removal. Instead, practical barriers -- slow mixing and imperfect quality control -- reveal watermarking to be far more robust than theoretical models suggest. The gap between idealized attacks and real-world feasibility underscores the need for stronger watermarking methods and more realistic attack models.

Figures

Figures reproduced from arXiv: 2505.06827 by the authors.

Figure 1
Figure 1. InternLM Quality Distribution by Watermarking Scheme [PITH_FULL_IMAGE:figures/full_fig_p015_1.png] view at source ↗
Figure 2
Figure 2. Perplexity Distribution by Watermarking Scheme [PITH_FULL_IMAGE:figures/full_fig_p015_2.png] view at source ↗
Figure 3
Figure 3. Unique Bigrams Distribution by Watermarking Scheme [PITH_FULL_IMAGE:figures/full_fig_p016_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Grammar Errors Distribution by Watermarking Scheme [PITH_FULL_IMAGE:figures/full_fig_p016_4.png]
Figure 5
Figure 5. Figure 5: Attack success rate (ASR) vs. detection threshold for the Adaptive watermarking scheme. Each curve [PITH_FULL_IMAGE:figures/full_fig_p030_5.png]
Figure 6
Figure 6. Figure 6: Attack success rate (ASR) vs. detection threshold for the SIR watermarking scheme. The plot shows the [PITH_FULL_IMAGE:figures/full_fig_p031_6.png]
Figure 7
Figure 7. Figure 7: Attack success rate (ASR) vs. detection threshold for the KGW watermarking scheme. Different curves [PITH_FULL_IMAGE:figures/full_fig_p031_7.png]
Figure 8
Figure 8. Figure 8: Rolling success rate for GPT-4o generations, which are unwatermarked. [PITH_FULL_IMAGE:figures/full_fig_p033_8.png]
Figure 9
Figure 9. Figure 9: Rolling success rate for the KGW watermark. [PITH_FULL_IMAGE:figures/full_fig_p034_9.png]
Figure 10
Figure 10. Figure 10: Rolling success rate for the SIR watermark. [PITH_FULL_IMAGE:figures/full_fig_p035_10.png]
Figure 11
Figure 11. Figure 11: Rolling success rate for the Adaptive watermark. [PITH_FULL_IMAGE:figures/full_fig_p036_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 8 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Bender, Timnit Gebru, Angelina McMillan-Major, and Shmargaret Shmitchell

    Emily M. Bender, Timnit Gebru, Angelina McMillan-Major, and Shmargaret Shmitchell. 2021. https://doi.org/10.1145/3442188.3445922 On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, FAccT '21, page 610–623, New York, NY, USA. Association for Computing...

    arXiv 2021

  4. [4]

    Sid Black, Gao Leo, Phil Wang, Connor Leahy, and Stella Biderman. 2021. https://doi.org/10.5281/zenodo.5297715 GPT-Neo: Large Scale Autoregressive Language Modeling with Mesh-Tensorflow . If you use this software, please cite it using these metadata

    doi:10.5281/zenodo.5297715 2021

  5. [5]

    Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert - Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litw...

    arXiv 2020

  6. [6]

    Zheng Cai, Maosong Cao, Haojiong Chen, Kai Chen, Keyu Chen, Xin Chen, Xun Chen, Zehui Chen, Zhi Chen, Pei Chu, Xiaoyi Dong, Haodong Duan, Qi Fan, Zhaoye Fei, Yang Gao, Jiaye Ge, Chenya Gu, Yuzhe Gu, Tao Gui, Aijia Guo, Qipeng Guo, Conghui He, Yingfan Hu, Ting Huang, Tao Jiang, Penglong Jiao, Zhenjiang Jin, Zhikai Lei, Jiaxing Li, Jingwen Li, Linyang Li, S...

    arXiv 2024

  7. [7]

    Wei-Lin Chiang, Lianmin Zheng, Ying Sheng, Anastasios Nikolas Angelopoulos, Tianle Li, Dacheng Li, Hao Zhang, Banghua Zhu, Michael Jordan, Joseph E Gonzalez, et al. 2024. Chatbot arena: An open platform for evaluating llms by human preference. arXiv preprint arXiv:2403.04132

    arXiv 2024

  8. [8]

    DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, Bing Xue, Bingxuan Wang, Bochao Wu, Bei Feng, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai D...

    arXiv 2025

Show all 38 references
  1. [9]

    Jesse Dodge, Maarten Sap, Ana Marasovic, William Agnew, Gabriel Ilharco, Dirk Groeneveld, and Matt Gardner. 2021. https://arxiv.org/abs/2104.08758 Documenting the english colossal clean crawled corpus . CoRR, abs/2104.08758

    2021 arXiv

  2. [10]

    Nicolai Dorka. 2024. Quantile regression for distributional reward models in rlhf. arXiv preprint arXiv:2409.10164

    2024 arXiv

  3. [11]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    2024 arXiv

  4. [12]

    Seungone Kim, Juyoung Suk, Shayne Longpre, Bill Yuchen Lin, Jamin Shin, Sean Welleck, Graham Neubig, Moontae Lee, Kyungjae Lee, and Minjoon Seo. 2024. https://doi.org/10.18653/v1/2024.emnlp-main.248 Prometheus 2: An open source language model specialized in evaluating other la...

    2024 doi

  5. [13]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. https://proceedings.mlr.press/v202/kirchenbauer23a.html A watermark for large language models . In Proceedings of the 40th International Conference on Machine Learning, volume 202 o...

    2023

  6. [14]

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fernando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. 2024. https://arxiv.org/abs/2306.04634 On the reliability of watermarks for large language models . Preprint, arXiv:2306.04634

    2024 arXiv

  7. [15]

    Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. https://arxiv.org/abs/2303.13408 Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense . Preprint, arXiv:2303.13408

    2023 arXiv

  8. [16]

    Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2024. https://arxiv.org/abs/2307.15593 Robust distortion-free watermarks for language models . Preprint, arXiv:2307.15593

    2024 arXiv

  9. [17]

    languagetool. 2023. https://github.com/languagetool-org/languagetool languagetool

    2023

  10. [18]

    Stephanie Lin, Jacob Hilton, and Owain Evans. 2021. https://arxiv.org/abs/2109.07958 Truthfulqa: Measuring how models mimic human falsehoods . CoRR, abs/2109.07958

    2021 arXiv

  11. [19]

    Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2024 a . https://arxiv.org/abs/2310.06356 A semantic invariant robust watermark for large language models . Preprint, arXiv:2310.06356

    2024 arXiv

  12. [20]

    Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. 2024 b . A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57(2):1--36

    2024

  13. [21]

    Chris Yuhao Liu, Liang Zeng, Jiacai Liu, Rui Yan, Jujie He, Chaojie Wang, Shuicheng Yan, Yang Liu, and Yahui Zhou. 2024 c . Skywork-reward: Bag of tricks for reward modeling in llms. arXiv preprint arXiv:2410.18451

    2024 arXiv

  14. [22]

    Yepeng Liu and Yuheng Bu. 2024. Adaptive text watermark for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML'24. JMLR.org

    2024

  15. [23]

    Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. https://arxiv.org/abs/1907.11692 Roberta: A robustly optimized BERT pretraining approach . CoRR, abs/1907.11692

    2019 arXiv

  16. [24]

    Scott Lundberg et al. 2022. Guidance. https://github.com/guidance-ai/guidance

    2022

  17. [25]

    Yang Minghao. 2024. infly/ I N F - O R M - L lama3.1-70 B · H ugging F ace --- huggingface.co. https://huggingface.co/infly/INF-ORM-Llama3.1-70B. [Accessed 11-02-2025]

    2024

  18. [26]

    OpenAI. 2024 a . https://platform.openai.com/docs/models/gpt-4-turbo Gpt-4 turbo . Accessed: 2025-02-10

    2024

  19. [27]

    OpenAI. 2024 b . https://cdn.openai.com/gpt-4o-system-card.pdf Gpt-4o system card . Accessed: 2025-02-10

    2024

  20. [28]

    OpenAI. 2025. https://openai.com/index/openai-o3-mini/ Openai o3-mini . Accessed: 2025-02-10

    2025

  21. [29]

    Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, Irwin King, and Philip S. Yu. 2024. https://aclanthology.org/2024.emnlp-demo.7 M ark LLM : An open-source toolkit for LLM watermarking . In Proceedings of th...

    2024

  22. [30]

    Junsoo Park, Seungyeon Jwa, Meiying Ren, Daeyoung Kim, and Sanghyuk Choi. 2024. https://arxiv.org/abs/2407.06551 Offsetbias: Leveraging debiased data for tuning evaluators . Preprint, arXiv:2407.06551

    2024 arXiv

  23. [31]

    Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners

    2019

  24. [32]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2019. https://arxiv.org/abs/1910.10683 Exploring the limits of transfer learning with a unified text-to-text transformer . CoRR, abs/1910.10683

    2019 arXiv

  25. [33]

    Saksham Rastogi and Danish Pruthi. 2024. https://doi.org/10.18653/v1/2024.emnlp-main.1005 Revisiting the robustness of watermarking to paraphrasing attacks . In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 18100--18110, Miami, F...

    2024 doi

  26. [34]

    Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2024. https://arxiv.org/abs/2311.08721 A robust semantics-based watermark for large language model against paraphrasing . Preprint, arXiv:2311.08721

    2024 arXiv

  27. [35]

    Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F

    Nisan Stiennon, Long Ouyang, Jeff Wu, Daniel M. Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F. Christiano. 2020. https://arxiv.org/abs/2009.01325 Learning to summarize from human feedback . CoRR, abs/2009.01325

    2020 arXiv

  28. [36]

    Haoxiang Wang, Wei Xiong, Tengyang Xie, Han Zhao, and Tong Zhang. 2024. Interpretable preferences via multi-objective reward modeling and mixture-of-experts. In EMNLP

    2024

  29. [37]

    Chi, Quoc Le, and Denny Zhou

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Ed H. Chi, Quoc Le, and Denny Zhou. 2022. https://arxiv.org/abs/2201.11903 Chain of thought prompting elicits reasoning in large language models . CoRR, abs/2201.11903

    2022 arXiv

  30. [38]

    Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak

    Hanlin Zhang, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. 2024. Watermarks in the sand: Impossibility of strong watermarking for generative models. In Forty-first International Conference on Machine Learning

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.