PaperlayerView exact revision on arXiv

Source-linked AI summary

Optimal Watermark Localization in Mixed-Source Large Language Model Texts

Jose H. Blanchet, T. Tony Cai, Xiang Li, Hao Liu, Qi Long, Weijie J. Su

arXiv:2608.14906v1stat.MEcs.CLcs.LGstat.ML

TL;DR

Localizing surviving watermark evidence in mixed-source LLM text is harder than detecting it globally. The paper develops pivotal-statistic multiple testing and adaptive thresholding, showing that SPOT achieves the optimal discovery boundary while consistent classification remains impossible for coordinatewise rules.

  • Problem

    It remains unclear when watermark evidence can be localized in mixed-source LLM text, although token-level identification matters for distinguishing partial from extensive AI-generated content.

  • Method

    The paper formulates localization as token-level multiple testing with pivotal statistics and develops SPOT, an adaptive thresholding method using an estimated surviving watermark fraction.

  • Results

    Discovery is strictly harder than detection, consistent classification is impossible for coordinatewise pivot rules, and SPOT attains the optimal discovery boundary with near-optimal power.

  • Takeaways & Limitations

    The paper delineates achievable regimes for watermark localization and provides adaptive discovery without knowing problem-specific exponents or time-varying next-token distributions.

  • Takeaways & Limitations

    SPOT’s surviving-fraction estimation can become a practical bottleneck at low temperatures, and the current procedure is batch-based.

Abstract

from arXiv · show

Watermarking provides a principled way to authenticate text generated by large language models (LLMs). In practice, however, the final text may be mixed-source, with watermark evidence surviving at only a subset of token positions after rewriting, insertion, deletion, or paraphrasing. Although prior work has studied global detection of watermark signals, when such signals can be localized remains unclear. We formulate watermark localization as a token-level multiple-testing problem based on pivotal statistics, with a latent indicator recording whether watermark dependence survives at each position. Under an asymptotic regime indexed by exponents for signal sparsity, next-token concentration, and effective-vocabulary growth, we derive a sharp boundary for global detection and phase transitions for discovery and classification within the class of coordinatewise pivot-based localization rules. We show that discovery is strictly harder than detection and that consistent classification is impossible across the parameter regime within this class. We then develop an adaptive thresholding method that does not require knowledge of the exponents or time-varying next-token distributions, but uses a data-driven estimate of the surviving watermark fraction. The method attains the optimal discovery boundary and near-optimal discovery power relative to homogeneous pivot-based rules. Simulations support the theoretical phase transitions, while experiments on model-generated texts demonstrate practical localization performance under common edit mechanisms.

1 Introduction

The paper frames watermark localization in edited, mixed-source LLM text as a token-level multiple-testing problem and characterizes its statistical limits. It shows localization is harder than global detection, while proposing an adaptive method that achieves the optimal discovery boundary.

  • Motivation: Edits such as paraphrasing, rewriting, insertion, and deletion can erase watermark dependence at some positions, motivating token-level localization in mixed-source text.The verifier observes only the final text, so surviving watermark evidence may occur at only a subset of positions.
  • Statistical formulation: The framework assigns each position a latent survival indicator θ_t and models a pivotal statistic under either a null law or a watermark-induced alternative determined by the local NTP distribution.θ_t = 1 denotes surviving watermark dependence, whereas θ_t = 0 denotes erased dependence.
  • Statistical limits: The theory derives an explicit detection boundary and sharp discovery and classification phase transitions in an asymptotic regime indexed by sparsity, NTP concentration, and effective-vocabulary exponents.These results apply within the class of coordinatewise pivot-based localization rules.
  • Statistical limits: Discovery is strictly harder than global detection, and consistent classification is impossible throughout the considered (p, q, α) regime.When α = 0, discovery can be impossible even when global detection remains possible in some regimes.
  • Adaptive methodology: SPOT achieves discovery throughout the discoverable region without knowing p, q, α, or time-varying NTP distributions, using a data-driven estimate of the surviving watermark fraction.It is boundary-optimal and recovers, up to a constant factor, as many watermark-preserving positions as the best homogeneous pivot-based rule under the same false-discovery constraint.

2 Preliminaries

The paper frames watermark localization around a three-party watermarking protocol and token-level pivotal statistics that distinguish watermark-preserving positions from null-like positions. It focuses theoretically on the Gumbel-max watermark, whose explicit pivot distributions enable sharp localization analysis.

  • Watermarking protocol: A model provider embeds a secret-key watermark, users may edit the generated text, and a verifier with the key analyzes the submitted output.The protocol involves the model provider, user, and verifier, with the key hidden from the user but available to the verifier.
  • Watermark embedding: During autoregressive generation, watermarking modifies next-token sampling using a secret-key-dependent pseudorandom variable computed from prior tokens.At position t, the model forms an NTP distribution P_t and computes ζ_t from recent tokens and the shared key before sampling.
  • Pivotal statistics for watermark evidence: The verifier reconstructs ζ_1:n and uses paired token–pseudorandom observations to test whether watermark dependence survives at each position.Human-written or edited tokens are independent of ζ_t, whereas preserved watermark signals leave w_t coupled with ζ_t.
  • Pivotal statistics for watermark evidence: Pivotal statistics reduce localization to distinguishing null-like positions from watermark-preserving positions, with null distribution U(0,1) and an alternative distribution determined by the local NTP distribution.The resulting coordinatewise distinctions are formalized as a multiple-testing problem.
  • The Gumbel-max watermark: The theoretical analysis centers on the Gumbel-max watermark because its decoder and pivotal statistic have explicit distributional forms.For this watermark, Y_t equals the selected token’s uniform pseudorandom value; under watermark generation, larger values are more likely, producing a stochastically larger pivot.

3 Method

The method models watermark localization through token-level pivotal statistics and latent indicators of surviving watermark dependence. SPOT adaptively scans tail thresholds, estimates false-discovery levels using the surviving watermark fraction, and selects discoveries without requiring the unknown time-varying NTP distributions.

  • Statistical formulation: Each token’s pivotal statistic Y_t measures watermark evidence, while latent θ_t indicates whether watermark dependence survives editing.The signal set is I = {t: θ_t = 1}, and localization becomes a token-level multiple decision problem.
  • Statistical formulation: The pivotal statistics follow a null-versus-signal mixture, (1 − θ_t)µ_0 + θ_tµ_1,P_t, allowing local decisions to depend separately on each position.The method focuses on coordinatewise rules δ_t = ϕ_t(Y_t).
  • SPOT: Under the null, p_t = 1 − F_0(Y_t) is i.i.d. U(0, 1), so unusually small p-values or large F_0(Y_t) values indicate candidate watermark-preserving positions.SPOT searches for positions whose pivotal statistics are unusually abnormal under µ_0.
  • SPOT: SPOT scans thresholds τ(u) = 1 − n^-u and estimates the candidate tail’s false-discovery level using the observed tail mass and an estimated surviving fraction.The proxy is T̂_n(u) = (1 − ε̂_n)S_0(τ(u))/(Ŝ_n(u) ∨ n^-1).
  • SPOT: The algorithm selects the smallest grid threshold with T̂_n(u) ≤ λ_n − η_n, then declares positions with Y_t > τ̂_n as discoveries.The smallest admissible u maximizes the discovery set among thresholds passing the false-discovery check.
  • SPOT: SPOT avoids direct density estimation by using tail probabilities, addressing heterogeneous distributions induced by unknown and time-varying NTP distributions.Its fraction estimator may vary, provided it satisfies the required accuracy condition.

4 Theoretical Guarantees

Theoretical analysis identifies phase transitions for detection, discovery, and classification under latent watermark-survival indicators. It also proves that SPOT adaptively achieves the discovery boundary and near-optimal discovery power.

  • Assumptions: Latent indicators θ_t model whether editing preserves watermark dependence, creating token-level null-versus-signal structure for pivotal statistics.When θ_t = 1, the token remains coupled with the watermark; when θ_t = 0, dependence is erased.
  • Detection boundary: Global detection is possible exactly when p + q < 1 and 2p + q < 1 + α, away from the boundary.Equivalently, the active boundary is p + q = 1 for p < α and 2p + q = 1 + α for p ≥ α.
  • Discovery boundary: Discovery requires p < α and p + q < 1; otherwise, no local decision rule can find even one surviving watermark position.With fixed effective vocabulary, α = 0, discovery is impossible.
  • Classification: No sequence of local decision rules achieves consistent classification for any p, q ∈ [0, 1] and α ∈ [0, 1).Surviving watermark dependence does not guarantee that the pivotal statistic is sufficiently separated from the null law.
  • Adaptive optimality: SPOT achieves discovery throughout the discoverable region without knowing p, q, α, or the NTP distributions P1:n.It scans tail thresholds and estimates the surviving watermark fraction from the data.
  • Discovery efficiency: SPOT attains a constant fraction of the largest expected true discoveries among homogeneous local rules satisfying the target false-positive constraint.This establishes near-oracle discovery power up to lower-order terms.

5 Simulations

Simulations instantiate the mixed-source watermark model with sparse, temporally dependent survival and mildly varying next-token distributions. Across one- and two-dimensional studies, SPOT’s empirical discovery transitions align increasingly closely with the theoretical boundary as text length grows.

  • Simulation setup: The simulations set ε_n = 0.5n^-p, Δ_n = n^-q, α ∈ {0, 0.25, 0.5, 0.75}, and |W_n| = 2 + floor(n^α).The construction uses one core token and floor(n^α) light tokens, corresponding to r = 0.
  • Simulation setup: Next-token distributions vary through a stationary two-state Markov process, while watermark survival follows an independent temporally dependent Markov chain with mean ε_n.The next-token regimes persist with probability 0.95, and surviving positions typically occur in short bursts.
  • Simulation setup: Each pivotal statistic follows the null law μ_0 when the signal is absent and the watermark-induced alternative μ_1,P_t when it survives.The resulting dependence across positions is inherited from the geometrically mixing process governing (P_t, θ_t).
  • Evaluation metric: SPOT’s discovery error combines marginal false discovery control with the probability of making no discovery, so smaller values indicate better performance.The discovery set is S_δ = {t : δ_t = 1}.
  • Phase transitions: The predicted discoverable region is p < α and p + q < 1, with fixed-q transition p⋆(q; α) = min{α, 1 − q}.For q = 0.4, the predicted transition is min{α, 0.6}; for p = 0.6, the transition is q = 0.4 when α > 0.6, while α ≤ 0.6 is non-discoverable.
  • Phase transitions: As n increases, empirical transitions sharpen and align more closely with the theoretical boundary, including the q = 0.4 transition when p = 0.6 and α > 0.6.When α ≤ 0.6, the error remains high across the entire p = 0.6 slice.

6 Open-source Model Experiments

Experiments on OPT-1.3B continuations evaluate SPOT against AOL under random, adversarial, and roundtrip edits across generation temperatures. SPOT generally outperforms or matches AOL, with the clearest gains at high temperatures and plugin degradation at low temperatures.

  • Experimental setup: The study generates 400-token OPT-1.3B continuations from 1,000 C4 documents using five-token repeated-context masking and temperatures 0.3–1.Post-edit sequences are evaluated after simulated human modifications.
  • Evaluation: Localization is evaluated by IoU, TPR, and token-level FPR against ground-truth watermark-preserving positions.IoU penalizes both missed and extra selected locations, while TPR measures recovered true locations.
  • Random edits: At T = 1, both SPOT-oracle and SPOT-plugin substantially outperform AOL in IoU and TPR across random edits.The advantage is especially clear in TPR, where SPOT recovers more surviving watermark-preserving locations across edit fractions.
  • Temperature effects: At T = 0.5, SPOT-oracle remains comparable to AOL and performs better under random deletion, whereas SPOT-plugin performs worse.The passage attributes plugin degradation mainly to reduced accuracy of the surviving-fraction estimator at lower temperatures.
  • Other edit mechanisms: Under adversarial edits and roundtrip translation, SPOT variants outperform AOL at T = 1 and remain competitive or comparable at lower temperatures.At T = 0.7 in the adversarial setting, SPOT-oracle and AOL have comparable performance while SPOT-plugin remains competitive.
  • Computational cost: Conditional on precomputed pivots, SPOT-plugin requires 0.005–0.008 seconds per sample versus 0.009–0.016 seconds for AOL.Pivot recomputation is shared across methods and dominates total runtime.

7 Discussion

The paper frames watermark localization in mixed-source LLM text as token-level multiple testing and characterizes limits for detection, discovery, and classification. It also identifies open challenges involving fraction estimation, coordinatewise recovery limits, and extending the analysis beyond token-level watermarks.

  • Contributions: The paper formulates localization as token-level multiple testing using pivotal statistics and latent indicators for watermark survival after editing.The statistical regime captures sparse surviving signals, concentrated next-token distributions, and growing vocabularies.
  • Open directions: Estimating the surviving watermark fraction can become a practical bottleneck, especially at low temperatures with more concentrated next-token distributions.The implementation uses Li et al.’s fraction estimator, although the theory permits any estimator satisfying a suitable accuracy condition.
  • Open directions: Consistent classification is impossible for coordinatewise localization rules, leaving stronger recovery under structural assumptions or cross-position procedures as an open possibility.Frequent switching between watermark-preserving and null states makes exact token-level recovery too demanding.
  • Open directions: Extending the analysis to other token-level watermarking schemes is relatively direct when valid individual-position pivotal statistics exist.Semantic or sentence-level watermarks instead encode information through meanings, paraphrase-invariant features, or larger text-unit representations.

Supplementary Material · A An Example of a Generation–Editing Process · B Proof for Theoretical Guarantees

The supplementary material constructs a finite-memory generation–editing example satisfying the paper’s assumptions and supplies proofs of the theoretical guarantees. It establishes joint Markov structure, mixing and run-length control, while formalizing the pivotal-statistic mixture laws used in the proofs.

  • A An Example of a Generation–Editing Process: A finite-memory state summary with exogenous editing innovations models dependence between generation and editing while satisfying Assumptions 4.1 and 4.3.The construction uses a joint state combining generation and edit status.
  • A An Example of a Generation–Editing Process: The joint state process is time-homogeneous Markov, although the marginal edit-status process need not be Markov.The marginal process is Markov only under an additional condition restricting dependence on the generation state.
  • Supplementary Material: Replacing exact survival probability εn with band bounds changes threshold constants but leaves detection, discovery, and classification exponents unchanged.The band condition allows survival probability to depend on generated history through Ft−1.
  • A An Example of a Generation–Editing Process: Doeblin minorization gives exponential tails for consecutive surviving-watermark runs, while the longest run across n positions is typically of order log n.The condition permits occasional longer bursts but excludes heavy-tailed or polynomially long persistent regimes.
  • B Proof for Theoretical Guarantees: The appendix proves the theoretical guarantees in main-text order, presenting primary arguments first and deferring auxiliary lemma proofs until after the relevant theorem.This organization is intended to keep the main argument transparent while retaining verification details.
  • B Proof for Theoretical Guarantees: The proofs represent observed pivotal statistics as a conditional mixture of null and watermarked-component laws, with effective survival weights bounded between cεn and Cεn.In the Gumbel–max case, the null law is uniform on (0, 1), while the watermarked-component law depends on Pt.

B.1 Proof of Theorem 4.1: Detection boundary

The proof reduces global detection to autoregressive Hellinger-affinity bounds and derives a sharp phase boundary governed by p, q, and α. The null and alternative laws merge when max{p + q, 2p + q −α} > 1, while complementary conditions yield asymptotically vanishing testing error.

  • Hellinger reduction: The proof combines an autoregressive Hellinger-affinity reduction with dominant–core–light vocabulary estimates to control the joint null–alternative distance.The one-step calculation is the new ingredient; tensorization and affinity recursion propagate it across token positions.
  • One-step estimates: The one-step Hellinger scale is established uniformly over admissible next-token distributions, with almost-sure lower bounds after conditioning on the observed past.For p = 0, the second line specializes to H2 ≍∆n.
  • Merging regime: The joint null and alternative laws merge whenever max{p + q, 2p + q −α} > 1.The proof treats p > α through the condition 2p + q −α > 1 and 0 < p ≤α through p + q > 1.

B.2 Proof of Theorem 4.2: Discovery boundary

The proof establishes the discovery boundary for coordinatewise local rules by showing achievability when p < α and p + q < 1, and impossibility when p + q > 1 or p ≥ α. It reduces impossibility to right-tail threshold rules and derives the result from pivotal-statistic tail bounds.

  • Reduction: For every local rule, a coordinatewise right-tail threshold rule is at least as good in expected false and true discoveries.Thus, proving impossibility for right-tail threshold rules suffices to prove impossibility for all local rules.
  • Achievability: Discovery is achievable when p < α and p + q < 1 using a constant-threshold local rule.Choosing u ∈ (p + q, α + q) yields vanishing mFDR and discoveries with probability tending to one.
  • Impossibility: Discovery is impossible when p + q > 1 because any rule with vanishing mFDR has expected discoveries tending to zero.Markov’s inequality then implies that the probability of making at least one discovery tends to zero.
  • Impossibility: No local rule achieves discovery when p ≥ α because the false-positive-to-true-positive ratio remains bounded away from zero.The uniform signal-tail domination prevents mFDR from vanishing in this regime.
  • Tail bounds: The watermarked pivotal-statistic tail scales as n^-u + n^-q for 0 < u < α + q and as n^(α-u) for u ≥ α + q.These bounds hold uniformly over admissible next-token distributions and drive the achievability and impossibility arguments.

B.3 Proof of Theorem 4.3: Impossibility of classification

The proof shows that no coordinatewise pivot-based local rule can achieve consistent classification. It derives contradictions for both q > 0 and q = 0 by showing classification necessarily incurs too many false discoveries or insufficient true discoveries.

  • Proof strategy: Successful classification would require ETPδ = (1 + o(1))E|I| and EFPδ = o(E|I|).These conditions are established through Lemma B.11 and used as necessary requirements for the contradiction.
  • Conclusion: Thus, consistent classification is impossible throughout the parameter regime for the considered right-tail threshold rules.The proof reduces attention to right-tail threshold rules using Lemma B.8 and obtains contradictions in both q cases.
  • Case q > 0: For q > 0, the signal-tail bound forces An ≳ n, implying EFPδ ≳ n and contradicting the false-discovery requirement.Because n^(1−q) = o(n), the threshold mass must satisfy An ≳ n, while classification requires false discoveries to be negligible relative to E|I|.
  • Case q = 0: For q = 0, the lower bound η⋆ on next-token concentration yields ETPδ ≤ (1 − η⋆ + o(1))E|I|, contradicting successful classification.Classification implies EFPδ ≍ An = o(E|I|), making the additional term CεnAn negligible and leaving an asymptotic true-discovery deficit.

B.4 Proof of Theorem 4.4: Adaptive optimality for global detection

The proof establishes adaptive global detection by controlling the truncated Jager–Wellner statistic under the null and exhibiting tail points whose alternative deviations dominate stochastic fluctuations. In both parameter regimes, the statistic exceeds the null critical order with probability tending to one, so Type II error vanishes.

  • Null calibration: Under H0, nS_n^+(s) is at most of order log log n with probability tending to one, establishing the Type I error control.The null bound follows by comparing the truncated statistic with the untruncated Jager–Wellner statistic.
  • Alternative regimes: In the regime p ≥ α, choosing r_n = n^{-(α+q)} yields a detectable excess under the condition 2p + q − α < 1.At this transition-point tail, stochastic fluctuation is negligible relative to n^{-(p+q)}.
  • Conclusion: In both regimes, nK_2^+(F_n(r_n), r_n) → ∞ in probability, and local comparison transfers this divergence to the scanned statistic.The proof uses F_n(r_n)/r_n = O_P(1) and a positive upper-tail deviation with probability tending to one.
  • Conclusion: Consequently, S_n^+(s) exceeds the null critical order log log n with probability tending to one, and the Type II error vanishes.The chosen r_n is included in the scan range in each regime.

B.5 Proof of Theorem 4.5: Adaptive optimality for discovery · B.6 Proof of Theorem 4.6: Near-optimal number of discoveries

B.5 proves that SPOT’s data-driven threshold tracks the oracle crossing and achieves discovery with vanishing mFDR and a nonempty discovery set. B.6 shows that SPOT’s true-discovery count is within a constant factor of the best homogeneous pivot-based rule under the same false-discovery constraint.

  • B.5 Proof of Theorem 4.5: Adaptive optimality for discovery: SPOT’s proof proceeds by uniformly concentrating empirical tail counts, approximating the oracle false-discovery proxy, and transferring oracle-crossing localization to the selected threshold.The empirical proxy is sandwiched between oracle proxies at nearby levels, enabling the data-driven exponent to track the oracle exponent.
  • B.5 Proof of Theorem 4.5: Adaptive optimality for discovery: With probability tending to one, SPOT selects an exponent in (p + q, α + q).This follows from the oracle calibration and the assumption p < α.
  • B.5 Proof of Theorem 4.5: Adaptive optimality for discovery: SPOT makes at least one discovery with probability tending to one, so its discovery set is asymptotically nonempty.A deterministic comparison rule has diverging expected true positives, and SPOT’s discovery set contains that comparison set.
  • B.5 Proof of Theorem 4.5: Adaptive optimality for discovery: The oracle crossing occurs at u = p + q + log log n/log n + O(1/log n), up to the grid mesh Δu,n.The same expansion remains valid when the calibration level changes within [λn/2, 2λn].
  • B.6 Proof of Theorem 4.6: Near-optimal number of discoveries: B.6 upper-bounds every homogeneous rule by using monotone likelihood-ratio rearrangement to restrict attention to right-tail thresholds under the same mFDR constraint.For such rules, total null rejection mass An is comparable to expected false positives, while the mFDR constraint yields EFPδ ≤ 2λnETPδ.
  • B.6 Proof of Theorem 4.6: Near-optimal number of discoveries: ETPδSPOT ≳n1−p−q+o(1), and combining this lower bound with the homogeneous-class upper bound proves SPOT’s true-discovery count is within a constant factor of optimal.The comparison is made over the benchmark class Dhom_n(λn), together with SPOT’s false-discovery bound.

C Additional Details for the Simulation Studies · D Details and Additional Results of Language Model Experiments · D.1 Additional Experimental Details

The appendices detail simulation generation, pivotal-statistic sampling, phase-transition evaluation, and real-LLM experimental procedures. They specify temporally heterogeneous watermark-survival processes, edit-based localization evaluation, and empirical false-positive-rate control.

  • C Additional Details for the Simulation Studies: Simulations use ε_n = 0.5n−p, Δ_n = n−q, α ∈{0, 0.25, 0.5, 0.75}, and |W_n| = 2 + ⌊n^α⌋.The vocabulary contains one dominant token, one core token, and ⌊n^α⌋ light tokens.
  • C Additional Details for the Simulation Studies: A persistent two-state Markov regime process with ρ_Z = 0.95 creates temporally dependent, heterogeneous NTP distributions while preserving the assumed asymptotic exponents.The process is initialized at stationarity, and each regime corresponds to a constant value of Z_t.
  • C Additional Details for the Simulation Studies: Watermark-survival indicators form an independent stationary Markov chain with mean ε_n, producing short bursts because b_n ≍1.θ_t = 1 denotes a surviving watermark signal, while θ_t = 0 follows the null law.
  • C Additional Details for the Simulation Studies: Pivotal statistics are generated directly from scalar selected-token probability levels, yielding the exact mixture law used in theory and avoiding full vocabulary-sized pseudorandom vectors.Under the Gumbel-max watermark, the null pivot law is uniform on [0, 1].
  • C Additional Details for the Simulation Studies: Figure 9 averages the smallest discovery error over 200 trials for α ∈{0, 0.25}, with vertical dashed lines marking Theorem 4.2’s theoretical boundary.These slices complement the main simulations for α ∈{0.5, 0.75}.
  • D.1 Additional Experimental Details: Real-LLM watermarking uses a context window m = 5, hash-derived pseudorandomness, and repeated-context masking to reduce repetitive outputs.The watermark is added only when the length-m context has not appeared earlier in the generated history.
  • D.1 Additional Experimental Details: Experiments retain 1000 C4 examples, use the last 50 tokens as prompts, and generate OPT-1.3B watermarked continuations of length n = 400.Examples are truncated to 2028 tokens and retained when their truncated sequence length is at least 450.
  • D Details and Additional Results of Language Model Experiments: Localization evaluation covers random edits, adversarial edits, and roundtrip translation, selecting the largest IoU whose empirical FPR does not exceed target λ.Edited sequences are re-tokenized and padded or truncated, with watermark-preserving labels based on contiguous original blocks of length m + 1.

D.2 Additional Details for Compared Methods

The compared methods include SPOT-plugin, which estimates the surviving watermark fraction from pivotal-statistic mixtures, and AOL, an adaptive online localization baseline. Both methods are calibrated for fair empirical-FPR comparisons, while SeedBS is excluded because of low accuracy and prohibitive runtime.

  • SPOT-plugin: SPOT-plugin estimates the surviving watermark fraction ε_n from observed pivotal statistics using a known null law and an unknown alternative law.It models the statistic distribution as (1 − ε_n)F0 + ε_nF1 and estimates F1 from fully watermarked auxiliary data.
  • SPOT-plugin: SPOT-plugin estimates the alternative density ratio, applies a variance-reducing weight, and numerically solves Li et al.’s estimating equation for ε_n.The weight is ω_ε(y) = 1−b_r(y) / ((1−ε)+εb_r(y)).
  • Baseline method and calibration: AOL transforms Gumbel-watermark pivotal statistics into scores, smooths them with Aligator from multiple random circular starts, and averages fitted values into localization scores.Token t is labeled watermark-preserving when its averaged score exceeds the calibration threshold ζ.
  • Baseline method and calibration: For fixed empirical FPR constraints, thresholds are swept over predetermined grids and each method’s best IoU subject to the target constraint is reported.The AOL grid is ζ ∈ {1.00, 1.01, . . . , 3.00}; SPOT uses {0.01, 0.02, . . . , 1.00} ∪ {1.00, 1.05, . . . , 5.50}.
  • Compared methods: SeedBS is excluded because experiments found low accuracy and prohibitive runtime.

D.3 Additional Results

Additional results clarify that TPR is the most direct localization metric under fixed FPR, while IoU provides a stricter but potentially redundant overlap assessment. Across edit mechanisms, FPR levels, and temperatures, SPOT methods generally outperform or remain competitive with AOL, with stronger performance at higher temperatures.

  • Metric interpretation: Under fixed empirical FPR, TPR directly measures recovered watermark-preserving locations, whereas IoU is stricter and also penalizes false positives through its denominator.TPR is |bS ∩ S⋆|/|S⋆|; IoU is |bS ∩ S⋆|/|bS ∪ S⋆| and additionally varies with the size of S⋆.
  • FPR sensitivity: At T = 1, localization is evaluated under target FPR levels 0.01, 0.03, 0.06, and 0.09 for random substitution, insertion, and deletion edits.The additional results report IoU and TPR as functions of edit fraction across these mechanisms and FPR levels.
  • Temperature effects: SPOT-oracle and SPOT-plugin generally outperform or remain competitive with AOL across random edits and FPR levels, while lower temperature reduces absolute localization performance.At T = 0.7, SPOT’s advantage remains visible but is smaller, consistent with weaker usable watermark evidence.
  • Temperature effects: Across generation temperatures under empirical FPR constraints λ ∈{0.04, 0.07}, SPOT-oracle remains stable, SPOT-plugin depends on fraction-estimator accuracy, and both are strongest relative to AOL at higher temperatures.Tables 4 and 5 average results across specified random-edit rates and adversarial-edit budgets.
Loading 2608.14906v1…