Pith. sign in

REVIEW 6 major objections 6 minor 1 cited by

Robust Multi-bit Text Watermark with LLM-based Paraphrasers

T0 review · 6 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes a multi-bit text watermark that hides a binary message by alternating between two fine-tuned LLM paraphrasers at sentence boundaries, and reports detection AUC over 0.9999 with repeated paraphrases.

desk verdict Solid multi-bit paraphrasing watermark with real reproducibility; the abstract overstates sentence-paraphrasing robustness, but the method works in-domain and is worth refereeing. read the letter →

arxiv 2412.03123 v2 pith:MPDQTYDB submitted 2024-12-04 cs.AI

Xiaojun Xu , Jinghan Jia , Yuanshun Yao , Yang Liu , Hang Li This is my paper · ORCID
classification cs.AI
keywords textwatermarkingLLMparaphrasingmulti-bitwatermarksentence-levelencodingreinforcementlearningPPOtrainingadversarialrobustnessout-of-distributiongeneralization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a way to embed an arbitrary binary message in ordinary text by paraphrasing it. Two fine-tuned LLM paraphrasers are used alternately, one for bit 0 and one for bit 1, switching at sentence boundaries; a trained classifier then reads each sentence and recovers the bit. The authors report detection AUC above 0.99 (over 0.9999 with five repeats), fidelity that beats compared baselines, robustness to word substitution and sentence paraphrasing, and generalization to out-of-domain data. If correct, this gives a practical, stealthy multi-bit watermark for human-written and LLM-generated text, useful for provenance and copyright tracking.

What carries the argument

The load-bearing object is a pair of paraphrasers ($\theta_0$, $\theta_1$) and a binary text classifier ($\theta_d$) wired together by a sentence segmentor. During encoding the segmentor decides when a new sentence starts, and the next bit of the message decides which paraphraser generates the next tokens; during decoding the same sentence boundaries are re-discovered and each sentence is classified as bit 0 or bit 1. Training alternates: the decoder is updated to classify current paraphrases, and each paraphraser is updated with PPO using the decoder's bit accuracy plus a semantic-similarity reward, so the two paraphrasers learn to diverge in a way the decoder can exploit.

What would settle it

Measure bit accuracy after paraphrasing a watermarked text with a system known to merge two sentences into one or split one into two, without any alignment-correction step; if accuracy falls to roughly 50%, the sentence-alignment assumption is the point of failure. A null result, with accuracy staying high, would show the watermark signal lives somewhere other than sentence-level bit alignment.

Watch

Extended reading notes

Core claim

The central claim is that a text watermark can carry many bits, not just a yes/no flag, by making the paraphrase itself the carrier: sentence-level alternation between two behaviorally different paraphrasers encodes the message, and a co-trained sentence classifier decodes it. Encoder and decoder are optimized alternately, with the decoder supplying the reward that pushes each paraphraser to produce easily distinguishable output, while a similarity reward keeps meaning intact. The measured result is 95.6% bit accuracy and 99.81% detection AUC on 128-token texts, rising to over 99.99% AUC with five repeated paraphrases, at a similarity of 0.87 that is higher than the compared baselines.

Load-bearing premise

The load-bearing premise is that sentence boundaries and sentence order survive paraphrase, so each decoded sentence still lines up with the bit that encoded it; if a paraphraser merges, splits, or reorders sentences, the bit alignment shifts and decoding fails.

Editorial extensions

If this is right

  • With five repeats of the paraphraser, bit accuracy exceeds 0.99 and detection AUC exceeds 0.9999, so very high-confidence watermark detection is possible at 1.1B model scale.
  • The watermark survives random substitution of up to 20% of tokens, and an adversarially trained decoder keeps detection AUC above 0.985 even at 10% substitution.
  • Under mild sentence paraphrasing such as round-trip translation, detection AUC stays near 0.93 (or 0.97 with adversarial training), while compared baselines collapse toward chance.
  • Trained on C4, the watermark generalizes to out-of-distribution datasets such as HH, PKU, Reward, UltraFeedback, FineWeb, and Pile, with AUC above 0.97 for most of them.
  • The trade-off between fidelity and detectability is controlled by the reward weights $\lambda_s$ and $\lambda_k$, so the same pipeline can be tuned toward either a stronger signal or a closer paraphrase.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Our inference: the watermark is only as robust as the sentence-alignment assumption, so a natural extension is semantic or structural segmentation that survives sentence merges and splits.
  • Our inference: because the decoder is a text classifier, a style-flattening paraphrase that rewrites every sentence into the same stylistic register could erase the signal; a style-transfer attack is a direct way to test this.
  • Our inference: the encoding density is about one bit per 23 tokens, so short texts carry very few bits; applications that need longer messages would combine this method with a longer-document framing.
  • Our inference: the co-training reward couples detectability with fidelity through a scalar weight, leaving room for a multi-objective or contrastive reward that could push both metrics higher than any single scalar trade-off.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The paper proposes a multi-bit text watermarking method that embeds a binary message into a text by paraphrasing each sentence with one of two LLM paraphrasers, selected according to the current bit. A text classifier trained in a co-training loop with the paraphrasers decodes the message sentence-by-sentence. The authors evaluate on C4 RealNewsLike data, compare against several baselines (RemarkLLM, KGW, KTH, Waterfall), and report high bit accuracy and detection AUC, robustness to word substitution and sentence paraphrasing perturbations, and generalization to out-of-distribution datasets. The paper also provides an ablation of the similarity and KL regularization coefficients, examples of watermarked text, and an LLM-based stealthiness evaluation.

Significance. If the central claims hold, the paper makes a useful contribution to text watermarking: it demonstrates that a multi-bit watermark can be embedded via learned paraphrasing with very high in-distribution detectability, and it provides an open-source implementation, extensive baseline comparisons, and OOD evaluation. The co-training of encoder and decoder is a technically interesting extension of prior work (Xu et al., 2024). However, the significance is tempered by the fact that the headline robustness and fidelity claims are only partially supported by the reported experiments, especially under sentence-level paraphrasing, and the in-distribution AUC is an optimized objective rather than an independent measurement. The paper is therefore of interest to the watermarking community, but the claims need to be substantially qualified.

major comments (6)
  1. [Abstract; §4.3, Table 3] The abstract states that the pipeline is "robust under word substitution and sentence paraphrasing perturbations," but Table 3 shows that under Llama-2-7B paraphrasing (LlamaPara) the benign model's bit accuracy drops to 0.7137, AUC to 0.8649, and TPR@FPR=1% to 43.9%. The paper itself acknowledges in §4.3 that "all these text watermarking methods suffer from a significant performance drop under paraphrasing attacks." The robustness claim in the abstract is therefore overstated relative to the reported results, and the central claim of robustness under sentence paraphrasing is only partially supported.
  2. [§4.2, Figure 2; Abstract] The abstract and introduction claim "over 99.99% detection AUC" without qualification, but this number is achieved only with five repeated paraphrasing runs and selecting the best decode (Figure 2). The paper does not state this selection procedure in the abstract, nor does it report the fidelity of the selected output relative to a single run. Since selection-by-best-decode is a form of multiple hypothesis testing and can trade off fidelity, the abstract should explicitly state that the 99.99% figure requires five repeats and best-of-five selection.
  3. [§3.4, §4.1] The co-training loop optimizes the decoder on the encoder's outputs and the encoder on the decoder's rewards, so the in-distribution AUC in Table 1 is an optimized training objective, not an external evaluation. The paper does not state whether the C4 texts used for the main evaluation are disjoint from those used for training. If the evaluation is performed on the same texts seen during co-training, the high AUC does not measure generalization. The authors should clarify the train/test split and, if necessary, add a held-out evaluation; the OOD results in Table 4 partially mitigate this concern, but the in-distribution claim still needs a disjoint test set.
  4. [§3.1, Algorithms 1–2, §4.3] The multi-bit decoding relies on the assumption that sentence-level segmentation is preserved between encoding and decoding: Algorithm 1 assigns one bit per generated sentence and Algorithm 2 decodes one bit per detected sentence. If a paraphraser merges, splits, or reorders sentences, the bit-to-sentence alignment is lost and the decoded message length can differ from the encoded one. The paper does not specify how bit accuracy is computed when the decoded length differs, nor does it report how often boundary mismatches occur under the paraphrasing attacks in Table 3. Given that bit accuracy under LlamaPara falls to 0.71, this alignment issue is a load-bearing weakness that should be analyzed and disclosed.
  5. [Appendix B, Table 6] The fidelity claim ("keeping the semantic information of the original sentence") is undermined by the examples in Table 6. For instance, "Increasing employee contributions ... by 1 percent per year until those payments reach 50 percent of the total cost" becomes "The employee contributions to the annuity programs are up by 1 percent a year until they reach five percent of the total cost," changing 50% to 5%, and "I wanted to go all in on gambling last year" becomes "Steve said I wanted to go all in on gambling last year," altering the attribution. The paper's similarity metric (all-mpnet-base-v2) may not capture such content-level errors. The authors should either provide examples that preserve key numerical and relational information or qualify the fidelity claim.
  6. [Table 3] The adversarially trained model Ours(advt) improves AUC and bit accuracy under LlamaPara compared to Ours, but its TPR@FPR=1% drops from 43.9% to 36.8%. This is an unexpected and unexplained result: under the same perturbation, a higher AUC with a lower TPR at 1% FPR suggests a different score distribution that is not uniformly better. The paper should explain this discrepancy, as it affects the interpretation of the adversarial-training benefit.
minor comments (6)
  1. [Figure 1 caption] The caption contains a typo: "parapharse" should be "paraphrase".
  2. [§4.3] The text reads "The evaluation pipeline follows the standard protocal"; "protocal" should be "protocol".
  3. [§2.1] The phrase "vary-length watermark" should be "variable-length watermark" for consistency with standard terminology.
  4. [§3.4, Eq. (6)] Equation (6) has an empty argument in the definition of ℓinit(θ0, θ1; ); the trailing semicolon should be removed or the argument filled in.
  5. [Figure 2] The y-axis labels in Figure 2 are difficult to parse (e.g., values are shown as 0.99, 0.9, 0.0 without clear scale marks). Please use a standard axis with explicit tick labels and a legend that is readable at publication size.
  6. [§4.1, Baselines] The main results in Table 1 do not include Waterfall with κ=2, although κ=2 is mentioned in the baseline description; the authors should state why κ=2 is omitted from Table 1 (it appears only in Table 7 for the 7B model).

Circularity Check

0 steps flagged · score 0.0 of 10

The derivation is self-contained: the co-trained encoder/decoder pair is measured on held-out, OOD, and perturbed data, so no claim reduces by construction to its inputs.

full rationale

No significant circularity found. The paper's central mechanism is a co-training loop: the decoder is trained with the loss in Eq. (2), the encoder is trained with the PPO reward in Eq. (3), and Algorithm 3 alternates these updates. This is an optimization objective, not a hidden input that is later relabeled as a prediction. The reported in-distribution bit accuracy and AUC (Table 1) measure how well the jointly trained pair generalizes to held-out texts from the same distribution; this is a standard evaluation, not a forced consequence. Crucially, the paper provides independent grounding that does not reduce to the training reward: out-of-distribution evaluations on HH, PKU, Reward, UltraF, FineWeb, and Pile (Table 4), robustness under word substitution (Table 2) and sentence paraphrasing (Table 3), and comparisons against external baselines (RemarkLLM, KGW, KTH, Waterfall). The sentence-level segmentation assumption in Section 3.1 is an honest robustness limitation, and the paper itself reports large performance drops under Llama-2-7B paraphrasing in Table 3; this weakens the abstract's robustness claim but is a correctness concern, not circularity. The citation to Xu et al. (2024) for the co-training inspiration is self-referential but not load-bearing, because the present paper implements and empirically validates the mechanism rather than invoking an unverified theorem from prior work. The PPO similarity reward does overlap with the reported fidelity metric, but the paper explicitly attributes the higher similarity to this reward and compares against baselines under the same metric, so this is transparent optimization rather than circular derivation.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method's central performance claims are produced by an encoder-decoder loop where the decoder is the reward signal for the encoder, so in-distribution performance is partly optimized into existence. Independent support comes from OOD tests, perturbation tests, and baseline comparisons. Hand-chosen hyperparameters (lambda_w, lambda_s, lambda_k, lambda_JS) and the domain assumption of stable sentence segmentation carry much of the burden.

free parameters (4)
  • lambda_w = 0.1
    Weight for watermark reward in Equation 4, chosen by hand; controls detectability versus fidelity.
  • lambda_s = 1.0
    Weight for similarity reward in Equation 4, chosen by hand; ablation in Table 5.
  • lambda_k = 0.02
    KL penalty coefficient in PPO loss Equations 1 and 5, chosen by hand; ablation in Table 5.
  • lambda_JS = 1.0
    JS divergence penalty in initialization loss Equation 6, chosen by hand.
assumptions (4)
  • standard math PPO/GAE gives valid token-level advantage estimates and converges for the encoder reward.
    Used to fine-tune the paraphrasers in Section 3.4; unproved background assumption.
  • domain assumption Sentence-level segmentation is preserved under paraphrasing, keeping sentence boundaries and order intact.
    Section 3.1 states this; if false, bit-to-sentence alignment breaks and decoding fails.
  • domain assumption all-mpnet-base-v2 similarity is a valid proxy for semantic fidelity.
    Used both as training reward (rs in Equation 4) and as evaluation metric in Section 4.1.
  • domain assumption Two paraphrasers can be trained to diverge in style while both producing high-quality paraphrases.
    Core feasibility assumption behind the encoder design in Section 3.2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Multi-bit Text Watermark with LLM-based Paraphrasers." pith.science (2026). https://pith.science/paper/MPDQTYDB

@misc{pith2026241203123,
  author       = {Pith},
  title        = {Pith review of: Robust Multi-bit Text Watermark with LLM-based Paraphrasers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MPDQTYDB}},
  note         = {Machine review of arXiv:2412.03123}
}
read the original abstract

We propose an imperceptible multi-bit text watermark embedded by paraphrasing with LLMs. We fine-tune a pair of LLM paraphrasers that are designed to behave differently so that their paraphrasing difference reflected in the text semantics can be identified by a trained decoder. To embed our multi-bit watermark, we use two paraphrasers alternatively to encode the pre-defined binary code at the sentence level. Then we use a text classifier as the decoder to decode each bit of the watermark. Through extensive experiments, we show that our watermarks can achieve over 99.99\% detection AUC with small (1.1B) text paraphrasers while keeping the semantic information of the original sentence. More importantly, our pipeline is robust under word substitution and sentence paraphrasing perturbations and generalizes well to out-of-distributional data. We also show the stealthiness of our watermark with LLM-based evaluation. We open-source the code: https://github.com/xiaojunxu/multi-bit-text-watermark.

Figures

Figures reproduced from arXiv: 2412.03123 by the authors.

Figure 1
Figure 1. Our core idea is to inject the watermark into a [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 1
Figure 1. The overview of our watermark pipeline. During encoding, we use an encoder to parapharse the input text given a user-chosen key. During decoding, we extract the bits from the text using the decoder. process. Different segments in the generated text will cor￾respond to different bits in the message code. To decode the watermark message from a piece of watermarked text, we will divide the text into multiple segments, … view at source ↗
Figure 2
Figure 2. The detection performance of our watermark compared with baseline methods with multiple repeats of the paraphraser. Note that some methods do not support multi-bit watermark code, so they do not have a curve of bit accuracy in the left figure [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figures from the paper (2 more)
Figure 3
Figure 3. Figure 3: The prompt used to paraphrase the text in the encoder. I have two classes of text, C1 and C2, which have some intrinsic difference. I will provide you with lists of texts from bothclasses. Can you help me classify which class a new text is in? You answer should only co…
Figure 6
Figure 6. Figure 6: The prompt used to evaluate the watermark robustness under Llama paraphrasing [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SAMark: A Self-Anchored Text Watermarking with Paragraph-Level Paraphrase Robustness

    cs.CR 2026-05 unverdicted novelty 6.5 of 10

    SAMark uses self-anchored semantic green regions, multi-channel hyperbolic scoring, and diversity-aware filtering to reach 90.2% TP@FP1% detection under paragraph paraphrasing while preserving text quality.

Reference graph

Works this paper leans on

17 extracted references · 3 canonical work pages · cited by 1 Pith paper

  1. [1]

    and Fritz, M

    Abdelnabi, S. and Fritz, M. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 2021 IEEE Symposium on Security and Pri- vacy (SP), pp. 121–140. IEEE,

    work page 2021

  2. [5]

    H., Ferguson, C., Lapedriza, A., Jones, N., Gu, S., and Picard, R

    Jaques, N., Ghandeharioun, A., Shen, J. H., Ferguson, C., Lapedriza, A., Jones, N., Gu, S., and Picard, R. Way off-policy batch deep reinforcement learning of implicit human preferences in dialog. arXiv preprint arXiv:1907.00456,

    arXiv 1907

  3. [6]

    When it comes to fantasy sports and betting on NASCAR races, there’s nothing wrong with it,

    Examples of watermarked texts. Blue and green texts correspond to class-0 and class-1 texts respectively. Original Text Watermarked Text Similarity “When it comes to fantasy sports and betting on NASCAR races, there’s nothing wrong with it,” Gaughan said. “I wanted to go all in on gambling last year,” NASCAR executive Steve O’Donnell said. “We have so man...

    work page 2020

  4. [7]

    Robust distortion-free watermarks for language models

    Kuditipudi, R., Thickstun, J., Hashimoto, T., and Liang, P. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593,

    arXiv

  5. [8]

    Lau, G. K. R., Niu, X., Dao, H., Chen, J., Foo, C.- S., and Low, B. K. H. Waterfall: Framework for ro- bust and scalable text watermarking. arXiv preprint arXiv:2407.04411,

    arXiv

  6. [9]

    A semantic invariant robust watermark for large language models

    Liu, A., Pan, L., Hu, X., Meng, S., and Wen, L. A semantic invariant robust watermark for large language models. arXiv preprint arXiv:2310.06356,

    arXiv

  7. [10]

    Efficient estimation of word representations in vector space

    Mikolov, T. Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781,

    arXiv

  8. [11]

    Qiang, J., Zhu, S., Li, Y ., Zhu, Y ., Yuan, Y ., and Wu, X

    URL https://arxiv.org/ abs/2406.17557. Qiang, J., Zhu, S., Li, Y ., Zhu, Y ., Yuan, Y ., and Wu, X. Natural language watermarking via paraphraser-based lexical substitution. Artificial Intelligence, 317:103859,

    arXiv

Show all 17 references
  1. [14]

    Robust multi- bit natural language watermarking through invariant fea- tures

    Yoo, K., Ahn, W., Jang, J., and Kwak, N. Robust multi- bit natural language watermarking through invariant fea- tures. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 2092–2115,

  2. [15]

    Tinyllama: An open-source small language model, 2024a

    Zhang, P., Zeng, G., Wang, T., and Lu, W. Tinyllama: An open-source small language model, 2024a. Zhang, R., Hussain, S. S., Neekhara, P., and Koushanfar, F. {REMARK-LLM}: A robust and efficient watermarking framework for generative large language models. In33rd USENIX Security...

    arXiv

  3. [16]

    Secrets of rlhf in large language models part i: Ppo

    Zheng, R., Dou, S., Gao, S., Hua, Y ., Shen, W., Wang, B., Liu, Y ., Jin, S., Liu, Q., Zhou, Y ., et al. Secrets of rlhf in large language models part i: Ppo. arXiv preprint arXiv:2307.04964,

    arXiv

  4. [2018]

    Learning to watermark llm- generated text via reinforcement learning.arXiv preprint arXiv:2403.10553,

    Xu, X., Yao, Y ., and Liu, Y . Learning to watermark llm- generated text via reinforcement learning.arXiv preprint arXiv:2403.10553,

    arXiv

  5. [2019]

    Pku-saferlhf: Towards multi-level safety alignment for llms with human pref- erence

    Ji, J., Hong, D., Zhang, B., Chen, B., Dai, J., Zheng, B., Qiu, T., Li, B., and Yang, Y . Pku-saferlhf: Towards multi-level safety alignment for llms with human pref- erence. arXiv preprint arXiv:2406.15513,

    arXiv

  6. [2020]

    Proximal policy optimization algorithms

    Schulman, J., Wolski, F., Dhariwal, P., Radford, A., and Klimov, O. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347,

    arXiv

  7. [2021]

    Training a helpful and harmless assistant with reinforcement learning from human feedback

    Bai, Y ., Jones, A., Ndousse, K., Askell, A., Chen, A., Das- Sarma, N., Drain, D., Fort, S., Ganguli, D., Henighan, T., et al. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862,

    arXiv

  8. [2023]

    B., Zhang, J., He, T., Wang, Y ., Chuang, Y .- S., Wang, H., Shen, L., Van Durme, B., Khashabi, D., and Tsvetkov, Y

    Hou, A. B., Zhang, J., He, T., Wang, Y ., Chuang, Y .- S., Wang, H., Shen, L., Van Durme, B., Khashabi, D., and Tsvetkov, Y . Semstamp: A semantic watermark with paraphrastic robustness for text generation. arXiv preprint arXiv:2310.03991,

    arXiv

  9. [2024]

    L., Liang, P., and Hashimoto, T

    Gu, C., Li, X. L., Liang, P., and Hashimoto, T. On the learnability of watermarks for language models. arXiv preprint arXiv:2312.04469,

    arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.